Write operations on shared folders taking longer after the Change Auditor Agent is installed on a Windows 2008 R2 Domain Controller (4235718)

After installing the Change Auditor Agent on Windows 2008 R2 based Domain Controllers, write operations on shares hosted on the Domain Controller is takes longer. Stopping or removing the Change Auditor agent causes the same write process to be completed quicker. This behavior is most apparent when the copy is overwriting files in a share.

For example, a 6KB file may take 30 seconds to copy while the Change Auditor agent is running but less than a second when it is stopped.

Resolved in the latest release of CA.

WORKARUND

Disabling the Change Auditor GPO Driver will workaround the issue but it can impact GPO monitoring on the Domain Controller. It is required for GPO File monitoring which provides detailed GPO events recorded by Change Auditor. Therefore, it is recommended not to use the workaround on the Domain Controller with the PDCe role which would, typically, be used to edit GPOs.

Set the following registry key and restart the Change Auditor agent: