Question:

Does the SES (Subscription Entitlement Service) licensing software load itself into memory on startup, changes the registry controlset of the computer or adds services to the machine?

If so, does it hook directly into the kernel or other kernel connectors of Windows?

Answer:

A licensing component known as the CONNECTION Client is added as a startup item. Two processes, Bentley.Licensing.Service and Bentley.Connect.Client, run in the background as the current user but not as a Windows service. Neither hooks directly into the kernel (i.e. like a driver) but runs as a user process.