Windows Explored

I blogged earlier about a Microsoft comparison tool, the Change Analysis Diagnostic for Windows XP. The idea there was to go back to a specified date and look at what had changed on the system to help troubleshoot any potential issues occurring as the result of installed software. You can read about it here.

The Windows System State Analyzer works with later versions of Windows but is different in that you take a snapshot of the pre-install environment, install the application and then take a post-install snapshot of the same system. When complete, you can then run a comparison of the two files from within the System State Analyzer to see what has changed.

To obtain the tool, go to http://go.microsoft.com/fwlink/?LinkID=140110 (x86) or http://go.microsoft.com/fwlink/?LinkID=140109 (x64).

The State Analyzer is installed as larger package and will install a couple other utilities, which are not required to run this tool. After opening, you will be presented by the following window:

The first column is where you take the snapshot of the pre-install environment. Note that this does not necessarily need to be a pre-install snapshot. This can also be a post-install if the idea is to see what changes when an application is uninstalled or any pre/post configuration change. By default file activity, registry changes, service changes and driver changes are monitored. To change this, go to Tools > Options and add or remove the desired option:

The snapshot can take a while to complete depending on the amount of options selected. Start the snapshot by clicking the Start button in the first column. When done, make the intended system change and then take another snapshot from the second column. When done, you can view a detailed report (saved as an HTML file) or save it and click the Quick Comparison tab. The comparison can be reviewed at any time using this tool. Simply load the two files created earlier.

To read further, see this TechNet blog here.

UPDATE

Since writing this and installing on my workstation, I found an issue that causes a BSOD when Process Monitor is run. This is detailed in a later blog here.