The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Reviewing logons by privileged accounts

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next

  • Filter Privileges > Domain Admin

    • Returns logons for user accounts belonging to a predefined set of known privileged domain accounts (Enterprise Admins, Schema Admins, Administrators, Domain Admins, Server Operators, Account Operators, Backup Operators, and DS Restore Mode Administrator)

  • Filter Privileges > Local Admin

    • Returns logons for user accounts belonging to the local Administrators group

  • Select Domain Search option

    • Select specific domain accounts that you know to be privileged or potentially interesting (for example, if a customer tells you "IT Admins" is a privileged group)

:
Related articles
  • Reviewing logons by privileged accounts
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.2.0 > Common investigative workflows > Auditing an environment
  • Reviewing Logons by Privileged Accounts
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.1.9 > Common Investigative Workflows > Auditing an Environment
  • Monitor privileged account usage
    Endpoint Detection and Response with Forensics (EDRF) > Detect and handle potential threats with EDRF > Configure EDRF to detect potential threats > Threat hunting with advanced detection modules > Detection using Logon Tracker