FelixT asked a question.
We enabled Windows Defender ASR rules - block processes from stealing credentials from LSASS and Snowagent.exe shows up when audit mode is enabled. Can you please advise if blocking Snowagent.exe from LSASS will impact any Snow functionality?
Simply put blocking snowagent.exe will more than likely render the agent dead.
It should only be using LSASS to see what users have logged in etc. to allow correct reporting of user application use.
The agent may still function but be missing this key data but more than likely it will just stop it running.