Skip to main content
Solved

Winlogon and lsass under monitoring after updates on Win7 X64


Forum|alt.badge.img+5
As by the subject.............after this morning updates these 2 system processes were under monitoring. I corrected manually the situation but think it'd be better if webroot would do the thing automatically. Best Regards

Best answer by aieie

Just FYI I gathered this info following with attention another upgrade: immediately after the reboot related to the update process on every one of my PC (and I strongly suspect yours too, but you won't notice if you don't look quickly) winlogon,lsass (and mscorsvw too) are put under monitor. After a minute or two they all automatically go into allow even if you do anything at all with exclusions. Update related......a curiosity..............but definitely not a problem. Best Regards
View original
Did this help you find an answer to your question?

4 replies

Rakanisheu Retired
There are a number of reasons why these windows components can be monitored, it may not be due to a Windows update. My Win 7 PC hasnt behavied unusually, I will check my VM`s. Thanks for the information.

Sheltieuk
New Voice
Forum|alt.badge.img+19
  • New Voice
  • 133 replies
  • May 14, 2014
No problem on my Win 8.1 machine either, both processes still marked as allowed after installing latest MS updates.

Forum|alt.badge.img+5
  • Author
  • New Voice
  • 29 replies
  • May 14, 2014
It has to be related to updates..........the two were allowed before the update........monitored after it. Really strange............it happend on all our machines. But just today I installed two new machines............and if updates are applied before the installation of Webroot then winlogon and lsass are not monitored after webroot is installed.

Forum|alt.badge.img+5
  • Author
  • New Voice
  • 29 replies
  • Answer
  • May 26, 2014
Just FYI I gathered this info following with attention another upgrade: immediately after the reboot related to the update process on every one of my PC (and I strongly suspect yours too, but you won't notice if you don't look quickly) winlogon,lsass (and mscorsvw too) are put under monitor. After a minute or two they all automatically go into allow even if you do anything at all with exclusions. Update related......a curiosity..............but definitely not a problem. Best Regards

Reply