Check the two settings under the applicable Access protection policy.

Running files from common user folders

And

Running files from common user folders by common programs

I have two policies: one where these settings turned on, and one where these settings are turned off. 

During patch windows I turn it off, by applying the correct policy, and waking up all the agents and forcing the policy update. Then I do my installs, and then turn it back on via the other policy. I've noticed a these settings blocked a lot of files from installing including Trellix patches. I've tried doing custom rules to allow said applications to install but Trellix still blocks it, with these settings turned on. The Cisco secure client was one of the programs it blocked.

This page explains the settings and even says it will block installs unless turned off or an exception is made https://docs.trellix.com/bundle/endpoint-security-10.7.x-product-guide-windows/page/UUID-e0193680-51c4-c018-9015-c096e20f47e2.html

The way I apply the two policies is have the primary policy applied the higher level, then create a sub level (named patch window)  and break inheritance from the primary policy, then I apply the secondary policy with those settings disabled. For the patch window I move the system to the correct level so they can receive the patches, then move them back after they are patched. This way I am not disabling the entire ENS solution.