ChangeAuditor Agent leaks memory on Domain Controllers when 'AD Queries' module is licensed (4316014)

Upon installing ChangeAuditor Agent 6.0.158 (or below) on a Domain Controller the Agent process ('NPSrvHost.exe') steadily begins to consume memory when the 'ChangeAuditor for Active Directory Queries' module is licensed

WORKAROUND

1) Disable the 'AD Query Performed' event class in the CA Client under Administration | Auditing | Configuration | Audit Events. This will prevent further leaking of memory.

2) Reboot the DC(s) to free any memory already leaked.

3) Upgrade Coordinator, Client and Agents on the DC(s) to 6.0.159+

4) Re-enable the 'AD Query Performed' event class.

Note: Scheduling a reboot of the impacted DC(s) to clear the problem from memory is recommended as attempting to restart the ChangeAuditor Agent under these conditions may crash 'lsass.exe' and force the machine(s) to reboot which may not be desired.

STATUS

Resolved in ChangeAuditor 6.0.159+