-
Title
Upgrade of agent from 6.0 to 6.5 causes a reboot of server -
Description
The upgrade of agent from 6.0.181 to 6.5.183 causes a reboot of server. Deployment Results show unable to complete remote procedure.Review of Windows Application Event log shows crash of lsass.exe and the subsequent unloading of the ChangeAuditor CAADHook.dll. -
Cause
Change Auditor 6.5 enables logon auditing hooks, which were disabled in 6.0, and this new configuration is pushed to the agents, but on 6.0 Agents the logon auditing hook could fail to initialize. This would cause an issue with CAADHook, especially if the coordinator version is 6.5 or higher.
-
Resolution
Check the agent configuration xml to verify the hook is enabled, as the 6.5 coordinator sets CaptureLogonEvents="1" in the agent config by default. Previously, the 6.0 coordinator had CaptureLogonEvents="0" by default.
Disable the Logon Auditing Hook by setting CaptureLogonEvents back to "0" by running a SQL query against Change Auditor database. So if not monitoring logon events, run the following SQL Querys against the ChangeAuditor database using SQL Server Management Studio.
First, verify if the 'GlobalConfigCaptureLogonEvents' field is present in the table.
If not present in the table then run this SQL queryInsert into SystemProperty (PropKey, PropValue) values ('GlobalConfigCaptureLogonEvents', 0)If present then run this SQL queryUPDATE [SystemProperty]SET [PropValue]=0WHERE [PropKey]='GlobalConfigCaptureLogonEvents'Next step - modify something in the configuration - like change one of the inclusion rules in any template, or turn off one of the events,Then, refresh agent configuration and restart the agent.