Microsoft has a tool called pktmon that gives you a stripped-down version of NPCAP that can be used to get Packet Captures from Windows machines without having to install a third-party piece of software. It’s not horrible to configure from the command line and you can go that route if you wish, but for most use cases and end users just getting into packet log investigation it can be a pain.

I have converted the script to an executable to make it easier to run for those that don’t have much PowerShell experience. Double-click the .exe, it loads PowerShell in the background and launches a GUI. It will automatically create C:\PacketCaptures. The warning you see is telling you it needs to run with administrative permissions so pktmon can interrogate your network interfaces.

Right-click and Run as administrator. By default the capture duration is 30 seconds. Adjust it up or down. Start the capture if possible, then work in the application you are having issues with for a set amount of time.

Once the timer completes it generates two files by converting the ETL into a PCAP and a TXT file. The TXT is for dropping into a private AI workflow. The PCAP is for Wireshark. Files get a date stamp so you can run it over and over.

PowerShellStart-PacketCapture.ps1
# Run elevated. pktmon is built into Windows.
pktmon start --capture --pkt-size 0 --file-name C:\PacketCaptures\capture.etl
Start-Sleep -Seconds 30
pktmon stop
pktmon etl2pcap C:\PacketCaptures\capture.etl --out C:\PacketCaptures\capture.pcap
pktmon etl2txt C:\PacketCaptures\capture.etl --out C:\PacketCaptures\capture.txt --verbose 3

Warning: Like all scripts you are responsible for its use. It works well for me. Your mileage may vary.