How do I use Process Monitor filters?

To use Process Monitor (ProcMon) effectively for Spirion troubleshooting, you must use filters to hide the millions of irrelevant Windows background events.

Without filters, ProcMon will likely crash or freeze your system due to the sheer volume of data.

Here is the exact setup to isolate Spirion "Access Denied" sources:

1. Open the Filter Menu

Launch Procmon.exe.
Click the Filter icon (funnel) in the toolbar or press Ctrl + L.

2. Add the "Process Name" Filter

This ensures you only see what the Spirion Agent is doing.

In the first dropdown, select Process Name.
In the second dropdown, select is.
In the text box, type: spirion.exe
Click Add, then Apply.

3. Add the "Result" Filter (To find the Block)

This isolates only the errors, so you don't have to scroll through thousands of "Success" events.

In the first dropdown, select Result.
In the second dropdown, select is.
In the text box, type: ACCESS DENIED
Click Add, then Apply.
- SME Tip: You can also add a filter for Result is SHARING VIOLATION to find files locked by other users.

4. Add the "Path" Filter (Optional)

If you are only interested in a specific folder or network share:

Select Path.
Select begins with.
Type the path (e.g., \\Server\Share\Data).
Click Add, then Apply.

5. How to Interpret the Results

Once the filters are active, run your Spirion scan. Look at the Result and Detail columns:

Result	Detail / Context	What it means
ACCESS DENIED	Desired Access: Read Data	NTFS Permissions: The Service Account lacks Read access to that file.
ACCESS DENIED	Desired Access: Write Attributes	Classification Block: The account lacks "Write Attributes" permission.
ACCESS DENIED	(Look for "Filter Driver")	AV/EDR Block: A security driver intercepted the request before it hit the disk.
SHARING VIOLATION		File Lock: The file is open in another app (Excel, Outlook, etc.).
BAD NETWORK PATH		Share Issue: The UNC path is incorrect or the server is down.

6. Pro-Tips for ProcMon

Drop Filtered Events: Go to the Filter menu and ensure "Drop Filtered Events" is checked. This prevents ProcMon from storing the millions of hidden events in your RAM, which prevents the tool from crashing during long scans.
The "Process Tree": Press Ctrl + T. This shows you if spirion.exe was "killed" by another process. If you see spirion.exe end abruptly and a security process (like CsAgent.exe for CrowdStrike) active at the same time, you've found your culprit.
Clear the Log: Click the Eraser icon (Ctrl + X) right before you start the Spirion scan so you have a clean window of data to analyze.
Auto-Scroll: Click the Magnifying Glass to stop capturing, then click the Scroll icon to jump to the most recent events.

Summary

Filter for Process Name is spirion.exe and Result is ACCESS DENIED. This will give you a clear list of every file the agent was blocked from touching and the specific reason why.