This is all well documented stuff and I won’t go into details – it’s here mostly for self reference (3rd time I had to chase this down in google).
(1) Install WDK to integrate the WinDbg engine with VS (not strictly necessary, but very convenient).
(2) Attach to the debugee via ‘User Mode’ transport:
(3) Continue execution, and break at the spot where the handle count is at ‘reference’ value.
(4) At the ‘Debugger Immediate Window’ type ‘!htrace –enable’
(5) Continue execution and break at a point where the handle count is supposed to be at reference value but isn’t.
(6) At the ‘Debugger Immediate Window’ type ‘!htrace –diff’.
The offending stack[s] should be visible at the debugger immediate window. If you get garbage, there’s a good chance you’re debugging a 32bit process on a 64bit machine.