The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Detecting Processes Accessing LSASS

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next
Skip to main content

In default mode, access to LSASS is not blocked, but an event is sent to the Endpoint Security server detection.

  1. After installation, run Process Guard in default detection mode.

  2. Go to the Process Guard home page to review the applications accessing LSASS.

  3. Decide, which processes need access to LSASS, and add them to the Process Guard Policy Exclusions.

  4. Continue to monitor for new events to establish a reasonable baseline, and then enable blocking mode and alerting capability.

    Note

    If you enable the alerting functionality too early, it can cause an overload of alerts for review and acknowledgment.

Related articles
  • Alert Settings
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Configuring the Process Guard Module‌ > Configuring the Process Guard Server Settings‌
  • Enabling the Block on Detection
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Configuring the Process Guard Module‌ > Configuring the Process Guard Agent Policy‌
  • Dependencies, Limitations and Known Issues‌
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Module Overview‌