Operating system dependencies for EDRF
EDRF requires specific operating system services to function. Do not disable default Windows services. EDRF does not depend on manually installed optional Windows features.
Do not disable PowerShell via Group Policy Objects. Several features in EDRF utilize PowerShell. Trellix Managed Services manages internal service dependencies. These dependencies are not visible in the Windows Services panel.
Windows process requirements
You must not terminate critical operating system processes. Termination causes severe system instability.
Avoid terminating or interfering with critical Windows processes such as:
smss.execsrss.exewininit.exeservices.exelsass.exewinlogon.exeCritical instances of
svchost.exe
Mandatory Windows services
Keep these services enabled to maintain platform health. Do not alter the startup settings.
Cryptographic Services: This service is a critical operating system process.
Base Filtering Engine: This service provides backend functionality for network filter drivers.
Local Session Manager: This service is a critical operating system process.
RPC Endpoint Mapper: This service is required for remote procedure call functionality.
Windows Event Log: This service provides data for forensics audits and event streaming. Disabling this service reduces data that can be collected from forensic audits and prevents Windows from recording events in logs that can be parsed and streamed by Event Streamer.
Power Service: This service is required for system operations.
Network Setup Service: This service is required for system operations.
Windows Management Instrumentation: This service is required for system operations.
User Profile Service: This service is required for system operations.
Security Accounts Manager: This service is required for system operations.
Windows Modules Installer: This service is required for system operations.
Security Center: This service is required for system operations.
Server: This service is required for system operations.
User Manager: This service is required for system operations.
Trellix services: Do not attempt to manually change the startup type or state of Trellix services and drivers.
Linux service and package requirements
The EDRF Client features require specific packages and services. Enable these dependencies on Linux endpoints.
systemdauditdandaudispdiptablesNote
Containment requires the
iptablespackage to be installed. Some Linux distributions have replacediptableswithnftables. In such cases,iptablesmust be installed for the containment feature to operate.syslogdandrsyslogdbusanddbus-daemon(present on most EDRF Client supported Linux distributions)