ndtrack.exe calls lsass.exe

[anhpham1652]

Hello,

Is there any case ndtrack.exe call lsass.exe? If yes, then why?

[jevans · Accepted solution]

Good morning Anh,
Thanks for reaching out on the Community!

I don't believe we'd call the executable directly.
The list of Child Processes we invoke for Windows machines during inventory can be found in the Gathering FlexNet Inventory guide, here:

https://docs.flexera.com/fnms/EN/GatherFNInv/index.html#SysRef/FlexNetInventoryAgent/topics/Common-WindowsChildProcesses.html

From some research, LSASS (Local Security Authority Subsystem Service) seems to handle user logins, password changes, and the Security log on a Windows device.
Is it possible the device itself is just keeping track in the Security logs of the actions of the agent?
What do we see in the Event Viewer's Windows > Security log while ndtrack's running?

https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service

[mfranz]

Hi,

Could it be that the Online help needs an update? I am specifically asking about Java stuff (https://community.flexera.com/t5/FlexNet-Manager-Forum/Can-Flexera-create-an-KB-article-explain-in-detail-what-ndtrack/m-p/222820#M14200), shouldn't there be something in the child processes section about this?

Best regards,

Markward

[ChrisG]

Are you wondering whether the online help needs an update to list lsass.exe as a process that ndtrack executes?

I don't think any update like that is required: lsass.exe is a system process, and ndtrack does not directly invoke new lsass.exe processes.

[mfranz]

Nope, it's really that the online help was mentioned here recently and I found not option in the help itself to request a review.

[anhpham1652]

So ndtrack.exe does call lsass.exe and lsass will be updated in document as child process of ndtrack?

[ChrisG]

No, that's not correct. As far as I know, the previous comments from @jevans and myself that ndtrack.exe does not call lsass.exe are correct.