---
title: "How do I use Process Monitor filters?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/how-do-i-use-procmon-filters"
language: "en"
last_updated: "2026-05-29T14:30:02.917Z"
---

# How do I use Process Monitor filters?

To use Process Monitor (ProcMon) effectively for Spirion troubleshooting, you must use filters to hide the millions of irrelevant Windows background events.

Without filters, ProcMon will likely crash or freeze your system due to the sheer volume of data.

Here is the exact setup to isolate Spirion "Access Denied" sources:

## 1\. Open the Filter Menu

-   Launch `Procmon.exe`.
-   Click the **Filter** icon (funnel) in the toolbar or press **Ctrl + L**.

## 2\. Add the "Process Name" Filter

This ensures you only see what the Spirion Agent is doing.

1.  In the first dropdown, select **Process Name**.
2.  In the second dropdown, select **is**.
3.  In the text box, type: `spirion.exe`
4.  Click **Add**, then **Apply**.

## 3\. Add the "Result" Filter (To find the Block)

This isolates only the errors, so you don't have to scroll through thousands of "Success" events.

1.  In the first dropdown, select **Result**.
2.  In the second dropdown, select **is**.
3.  In the text box, type: `ACCESS DENIED`
4.  Click **Add**, then **Apply**.
5.  -   *SME Tip:* You can also add a filter for `Result is SHARING VIOLATION` to find files locked by other users.

## 4\. Add the "Path" Filter (Optional)

If you are only interested in a specific folder or network share:

1.  Select **Path**.
2.  Select **begins with**.
3.  Type the path (e.g., `\\Server\Share\Data`).
4.  Click **Add**, then **Apply**.

* * *

## 5\. How to Interpret the Results

Once the filters are active, run your Spirion scan. Look at the **Result** and **Detail** columns:

| Result | Detail / Context | What it means |
| --- | --- | --- |
| **ACCESS DENIED** | Desired Access: Read Data | **NTFS Permissions:** The Service Account lacks Read access to that file. |
| **ACCESS DENIED** | Desired Access: Write Attributes | **Classification Block:** The account lacks "Write Attributes" permission. |
| **ACCESS DENIED** | (Look for "Filter Driver") | **AV/EDR Block:** A security driver intercepted the request before it hit the disk. |
| **SHARING VIOLATION** |  | **File Lock:** The file is open in another app (Excel, Outlook, etc.). |
| **BAD NETWORK PATH** |  | **Share Issue:** The UNC path is incorrect or the server is down. |

* * *

## 6\. Pro-Tips for ProcMon

-   **Drop Filtered Events:** Go to the **Filter** menu and ensure **"Drop Filtered Events"** is checked. This prevents ProcMon from storing the millions of hidden events in your RAM, which prevents the tool from crashing during long scans.
-   **The "Process Tree":** Press **Ctrl + T**. This shows you if `spirion.exe` was "killed" by another process. If you see `spirion.exe` end abruptly and a security process (like `CsAgent.exe` for CrowdStrike) active at the same time, you've found your culprit.
-   **Clear the Log:** Click the **Eraser** icon (Ctrl + X) right before you start the Spirion scan so you have a clean window of data to analyze.
-   **Auto-Scroll:** Click the **Magnifying Glass** to stop capturing, then click the **Scroll** icon to jump to the most recent events.

## **Summary**

Filter for **Process Name is** `spirion.exe` and **Result is** `ACCESS DENIED`. This will give you a clear list of every file the agent was blocked from touching and the specific reason why.