After installing Change Auditor agent version 7.6.2 on a non-DC host, the server eventually has resource spikes coming from the NpSrvHost.exe process, which is the main agent process, causing performance degradation or unexpected host behavior.
The CASupport.dll module and its hooks are causing the non-DC agent LSASS crashes in some environments running QCA agent 7.6.2 while leaving the rest of the CA agent auditing intact.
First, make sure the affected host has all the most recent Microsoft updates installed (up to July 2026). If the issue persists after the updates reboot, or they are already in place, then review the following:
WORKAROUND:
A temporary workaround to disable loading the CASupport.dll module. On the affected host, open or create the following key and value name with the value shown, and restart the agent service:
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor\Agent
Value Name: (DWORD) DisableLsaHook
Value: (DWORD) 1 (which means disabled; a value of "0" means enabled, which is the default)
SOLUTION:
The product team has logged defect ID 698390 and is working on a fix for this problem that will be released when it becomes available.
