ChangeAuditor driver library fails and may cause lsass.exe to crash and reboot the Domain Controller (4300244)

When the Change Auditor driver library 'CAADHook.dll' is unloaded during a restart of the Change Auditor Agent on a Domain Controller, lsass.exe crashes causing a reboot of the Domain Controller, when Tripwire Intrusion Detection software is installed on the Domain Controller

The following error is recorded in the Application Event log:

Faulting application name: lsass.exe, version: 6.1.7601.18719, time stamp: 0x54b7622f

Faulting module name: CAADHook.dll_unloaded, version: 0.0.0.0, time stamp: 0x5558072c Exception code: 0xc0000005

Fault offset: 0x00000000662f5891

Faulting process id: 0x338

Faulting application start time: 0x01d09669023859f0

Faulting application path: C:\Windows\system32\lsass.exe

Faulting module path: CAADHook.dll Report Id: 7d55b135-4d0b-11e5-8ce1-bc305bf2c1a0

WORKAROUND:

Reports from our customers have reported success with un-installing and re-installing both the Change Auditor Agent and the Tripwire agent.