-
Title
Attempting to stop Change Auditor agent on a Domain Controller may result in blue screen -
Description
Attempting to stop Change Auditor agent service on a Domain Controller may result in blue screen.
The memory dump may have analysis result similar to:BugCheck CC, {ffffcf847fb90fa4, 0, fffff8021f3b4be7, 0}Probably caused by : Change_Auditor for Active Directory 6.x.sys ( Change_Auditor_for_Active_Directory_6_x!create_in_target+33f )PAGE_FAULT_IN_FREED_SPECIAL_POOL (cc)Memory was referenced after it was freed. -
Cause
Product defect. -
Resolution
WORKAROUND
Disabling the Change Auditor GPO driver will prevent the issue from occurring at the cost of no detailed GPO audit events. Please note, a system reboot is required to clear the driver from memory before it will be fully unloaded.
Path:
For 7.0 and above:
HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor for Active Directory
For 6.9.x and below:
HKEY_LOCAL_MACHINE\SOFTWARE\Dell\ChangeAuditor for Active Directory
Type: DWord 32-bit
Name: DisableADDriver
Value: 1 (disabled)
0 (enabled - default)
STATUS
Resolved in the latest release of Change Auditor. The new releases use a new driver for auditing AD.
Quest does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.
-
Defect ID
13244