Services Hook will not load on Windows Server 2012/2012 R2 unless the server is rebooted (4314698)

Considering the following scenario:

1. Windows 2012/2012 R2
2. Change Auditor 5.9+ installed (6.5+ if Operating System is 2012 R2)
3. During Agent start-up the following warnings appear in the ServicesHook.dll.nptlog
   • 2015-01-14 12:04:57.559 [5212][WARN] Attached RPC function 1 at 000007F710649E00
   • 2015-01-14 12:04:57.560 [5212][WARN] DetourAttach() failed: 8
4. The Agent then returns to the stopped state and the following is recorded in the Change Auditor Agent Log
   • ​2015-01-14 12:04:58.559 [1604][ERROR][CServicesHook::Initialize(238)] Timeout waiting for service hook.
   • 2015-01-14 12:04:59.559 [1604][WARN][TrogdorLib::Common::CTrogdorService::StartImpl(182)] Error initializing sub-system {Services Hook (40)}.
   • 2015-01-14 12:04:60.559 [1604][ERROR][CMonitorService::OnStartFailed(512)] Failed to initialize some threads and sub-systems.

• TF00374817
• This is caused by the limitation of Microsoft Detours 2.0 on 64-bit platforms.
• Error 8 is raised when there are no more free memory locations

Workaround

Option 1

• Reboot the server will allow the Change Auditor Agent to start normally.

Option 2

• Disable the Services Hook via DisableSCMHook registry key.
• This can be enabled via Agent Maintenance Tray or via the following registry key:
  • Location: Registry
  • Path: HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor\Agent
  • Value Name: DisableSCMHook
  • Value Type: DWORD 32-bit
    • 1 - Disable services hook
    • 0 - Enable services hook (default)

Status

• Enhancement request TF00374817 has been submitted to Development for consideration in a future release of Change Auditor

Disclaimer

Quest does not provide support for problems that arise from improper modification of the registry.

The Windows registry contains information critical to your computer and applications.

Make sure you back up the registry before modifying it.

For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.