We are after specific monitoring of lsass.exe but even creating a custom process monitor does not reveal anything. I understand the special group Windows Services can not have processes added to it, but can we separate some of them out?
Solved! Go to Solution.
Hi. Unfortunately this is not possible in current version of our product.
Process Groups are created via a sequence of classifiers, and Windows System is created near the beginning of this process. Changing how lsass.exe is grouped would need to be handled as a feature request, but from code perspective, there are no huge obstacles to implementing it.