How to Set a SACL for LSAS Processes

The SACL is built into the actual object itself and so it's going to be there as long as that file exists yeah I think you're spot on. There are a lot of things you can do with that for instance um you could run a PowerShell script you could find document files PDF files  and now suddenly you can see file reads for those things. You know if you have to suppress some stuff you would expect but the moment you see Chrome or RAR or you know whatever like they just open up an LSAS process right? It doesn't survive past reboot I guess. did somebody open a handle to LSAS like a read handle to the LSAS process you can set