Change auditor agent on Windows 2012 R2 file servers starts and then stops unexpectedly.
The following is recorded in the agent log:
2018-04-05 13:52:11.494 [2276][INFO][LsassHookWorker::Run(55)] Running infinite to allow CAADHook to load support Dll
2018-04-05 13:52:11.494 [2276][INFO][NetProLib::Injection::DllInjector::Inject(289)] DllInjector(215df680) Inject process:lsass.exe dll:C:\Program Files\Common Files\Quest\detoured.dll
2018-04-05 13:52:11.526 [2276][WARN][NetProLib::Injection::DllInjector::_OpenProcess(800)] DllInjector(215df680) process not found
2018-04-05 13:52:11.541 [2276][ERROR][CLsaHook::Inject(279)] Support Dll initialization error (NetProLib::Injection::DllInjector::_OpenProcess - Unable to locate process id -1) on C:\Program Files\Quest\ChangeAuditor\Agent\CASupport.dll
2018-04-05 13:52:11.541 [1768][INFO][CLsaHook::InstallHook(240)] Support Dll Load complete
2018-04-05 13:52:11.541 [1768][INFO][CLsaHook::InstallHook(249)] Unloading LSA support dll
2018-04-05 13:52:11.557 [1768][INFO][NetProLib::Injection::DirectoryServiceAgentInjector::Unload(296)] Call ExecuteRemoteOperationControl
2018-04-05 13:52:11.557 [1768][INFO][CLsaHook::InstallHook(251)] LSA support dll unload complete
2018-04-05 13:52:11.557 [1768][ERROR][CSamEventSink::WorkerMain(932)] ChangeAuditor utility dll failed to install
2018-04-05 13:52:11.557 [1768][INFO][CRegistrySink::ProtectProcess(460)] PProtection (lsass.exe), Server 2012 R2 (1, 0, 0, 0, d000).
2018-04-05 13:52:11.682 [376][WARN][TrogdorLib::Common::CTrogdorService::StartImpl(185)] Error initializing sub-system {SAM Event Sink (29)}.
2018-04-05 13:52:11.682 [376][ERROR][CMonitorService::OnStartFailed(519)] Failed to initialize some threads and sub-systems.
2018-04-05 13:52:11.682 [376][INFO][TrogdorLib::Common::CCachedSharedAgentData::Shutdown(444)] SharedAgentData updater is shutting down
2018-04-05 13:52:11.682 [4656][INFO][TrogdorLib::Common::CCachedSharedAgentData::UpdateThreadProc(497)] SharedAgentData updater thread is exiting
2018-04-05 13:52:11.682 [376][INFO][TrogdorLib::Common::CCachedSharedAgentData::Shutdown(451)] SharedAgentData updater thread exited
2018-04-05 13:52:11.698 [376][WARN][CMonitorService::OnStopping(541)] Processing service STOP request!