DeviceProcessEvents | where FileName == "net.exe" // exclude local PC groups enumeration from the results, can generate FP // e.g. you have hits for local groups when Defender ATP collects the ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results
Feedback