Consider the following scenario...
1. The Change Auditor Agent is running on the DC and AD License is applied but no AD events are sent for changes which should produce events.
2. The CAADHook log contains the following error during Agent start-up:
1. Check the SDDL applied to the Application event log using the following command: