Trusted local group

Trusted local group is a feature that adds local groups to the trust model.

Application Control supports trusted users. You can add users as updaters to allow them to perform installations or update operations on a protected system. While adding the user information, you can also provide the domain details.

A local group can contain user accounts from one or more domains, and it shares common permissions and rights only within its own domain.

The trusted local groups feature is enabled by default.

How it works

Understanding how the TACC client processes user trust is key to managing this feature. When an action occurs that requires a trust check, the agent performs the following steps:

Initial user lookup: The agent first uses the Microsoft API LookupAccountSid to resolve the user's Security Identifier (SID) into a standard DOMAIN\username format.
Local group check: If the trusted local groups feature is enabled, the agent then calls the NetUserGetLocalGroups API to retrieve a list of all local groups to which the user belongs. This allows the agent to check if any of those groups are defined as trusted updaters in the policy.

In some environments, the NetUserGetLocalGroups API call can fail (often with an ERROR_ACCESS_DENIED code). If this happens, the agent falls back to looking up the username in the registry. This fallback mechanism can sometimes retrieve an incorrect domain for the user, leading to incorrect logging and trust validation issues.

If the feature is disabled, the second step is skipped. The agent relies solely on the output from the initial LookupAccountSid call, which provides the correct username and domain, avoiding potential API failures.

Configuration

You can add local groups as trusted updaters through either the ePO policy or the local command-line interface.

Using the ePO policy

To add a trusted local group in an Application Control policy, follow these steps:

Navigate to the desired Application Control policy in ePO.
Go to the Users tab.
Click Add.
In the UserID/Group field, enter the local group and/or user using one of the following formats:
- To trust all users within a specific local group: LOCALGROUP\*
  Example: Administrators\*
- To trust a specific user who is a member of a local group: LOCALGROUP\USERNAME
  Example: Power Users\jsmith
Note
<LOCALGROUP> and <USERNAME> are placeholders. Replace them with the actual names for your configuration (such as Administrators or jsmith). Do not use the literal words "LOCALGROUP" or "USERNAME".
Provide a descriptive Name and a User Label for tracking.
Save the rule and the policy.

Using the Command-Line Interface (CLI)

You can add trusted local groups directly on a managed endpoint using the sadmin command-line tool.

To trust all members of a local group:
sadmin updaters add -t <label> -u "LOCALGROUP\*"
Example: To add all members of the local "Power Users" group with the label "workflow-123":
sadmin updaters add -t workflow-123 -u "Power Users\*"
To trust a specific user within a local group:
sadmin updaters add -t <label> -u LOCALGROUP\USERNAME
Example: To add only the user "admin2" from the local "Administrators" group with the label "admin-task-456":
sadmin updaters add -t admin-task-456 -u Administrators\admin2

Enabling and Disabling the feature

The IsTrustedLocalGroupEnabled configuration setting controls the Trusted Local Groups feature. Disable this feature if you are not using local groups as updaters or if you experience user domain resolution issues.

Using the ePO - On-prem policy

ePO - On-prem manages the Trusted Local Group feature in managed environments. To enable the feature, set IsTrustedLocalGroupEnabled to 1 in the Configuration (Client) policy. To disable it, set the value to 0.

Note
If you change this setting using the CLI, the configuration reverts. This reversion happens when the system is in the LOCKDOWN state, and the Trellix Agent enforces the policy.

Using the CLI for standalone systems

Use the following commands to configure the feature on standalone systems.

To disable the feature, type:
sadmin config set IsTrustedLocalGroupEnabled=0
To enable the feature, type:
sadmin config set IsTrustedLocalGroupEnabled=1

Troubleshooting user name resolution

If the NetUserGetLocalGroups API call fails, the agent may cache an incorrect username from the registry, causing policy rules based on the correct user or domain to fail. You can verify this behavior by examining the agent logs.

Log comparison:

Feature disabled (Correct resolution): The logs show the correct user and domain being added to the cache.
INFO: utl.c : 1268: Added uname 'CORP\WKSTN-101' to cache.
Feature enabled (Incorrect resolution): The logs show the API call failing, and the client caching an incorrect user and domain from the registry.
INFO: utl_winnt_user.c: 1394: A system error has occurred when obtaining local groups list: 5 INFO: utl.c : 1268: Added uname 'EXTERNAL_DOMAIN.com\WKSTN-101' to cache.

If you do not use trusted local groups and experience this issue, disable the feature as a workaround.