ObjMon

ObjMon allows you to monitor kernel object activity in real time. Because many elements in the Windows kernel such as files, registry keys, symbolic links and events are represented as kernel objects, ObjMon can be used for a wide variety of purposes.

Although not every type of kernel object can be monitored by ObjMon, the following kernel object types are supported: Type, Directory, SymbolicLink, Token, Process, Thread, Job, Event, Mutant, Callback, Semaphore, Timer, KeyedEvent, WindowStation, Desktop, Section, Key, Port, Waitable Port, Adapter, IoCompletion., File and WmiGuid. We will be looking forward to extend this range in a future version of ObjMon.