The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Enabling the audit security system extension to collect and monitor event IDs

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next

The module can collect and monitor event IDs for the following events:

  • When an authentication package has been loaded into the Local Security Authority (EventId 4610)

  • A trusted logon process has been registered with the Local Security Authority (EventId 4611)

  • A notification package has been loaded by the Security Account Manager (EventId 4614)

  • A security package has been loaded by the Local Security Authority (EventId 4622)

  • A service was installed in the system (EventId 4697)

You must enable the Audit Security System Extension to collect and monitor these event IDs in a group policy.

  1. Launch the local group policy editor (gpedit.msc).

  2. Navigate to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System. Various subcategories of audit events are displayed.

  3. Right-click Audit Security System Extension and then select Properties.

    TS_EventIds1.png

  4. Select the Configure the following audit events, Success ,and Failure checkboxes.

    TS_EventIds2.png

  5. Click Apply.

For additional information see the Microsoft’s documentation here.

:
Related articles