The Domain Controller with the Quest Change Auditor (QCA) agent is hanging the server and causing unexpected crashes, even though it is already on version 7.6.2 or 7.6.3. We see that CAADHook DMP files are being generated on the affected Domain Controller.
CAADHook DMP files provided show that Active Directory raised the following request:
ERROR_DS_DRS_EXTENSIONS_CHANGED (0x2192) while processing a DRSGetNCChanges
This means the existing Directory Replication Service binding is no longer valid because the server-extension information changed and the binding must be renegotiated. CAADHook catches this expected Directory Services exception in its hook-level SEH handler and attempts to create a minidump. The expected behavior is that it should ignore it and let Microsoft handle it. However, it is now doing this.
The following workaround options are available (you can use any of them):
WORKAROUND #1 (Recommended): Bypass CAADHook SEH handling
Add or update the registry value below on the affected Domain Controller:
HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor for Active Directory
Value name: BypassHookSEH
Value type: DWORD
Value data: 1
This should allow the exception to continue to the normal Directory Services handler. Please note a reboot of the Domain Controller is required for the setting to take effect.
WORKAROUND #2: Disable Change Auditor DCSync auditing
The following will remove the DCSync auditing hook from the affected Domain Controller. However, DCSync-related Change Auditor events from that DC, including potentially irregular or suspicious replication activity, will no longer be captured. If DCSync auditing should remain enabled on other domain controllers, create and apply a separate agent configuration for the affected DC only.
To disable the Change Auditor agent DCSync auditing component, an update of the applicable Agent Configuration using the Set-CAAgentConfigurationSetting PowerShell cmdlet will be required. When prompted, specify:
SettingName: DcSyncAuditOption
SettingValue: 0
DcSyncAuditOption
Reference values:
0 — Disabled; the DCSync auditing hook is not installed.
1 — Enabled; the DCSync auditing hook is installed for auditing. This is the default.
Restart the Quest Change Auditor agent service after disabling or enabling the DCSync auditing component.
NOTE: You will need to request a session with Quest Support for assistance implementing workaround #2, since the usage instructions for the Agent Feature Flags are disclosed only to internal knowledge. It is advised to first try workaround #1, and if it doesn't work well, then workaround #2 could be considered as an alternative.
SOLUTION:
The product team has logged defect ID 742341, which is expected to have a fix implemented in version 7.7 of Change Auditor.
