-
タイトル
ChangeAuditor driver library fails and may cause lsass.exe to crash and reboot the Domain Controller -
説明
When the Change Auditor driver library 'CAADHook.dll' is unloaded during a restart of the Change Auditor Agent on a Domain Controller, lsass.exe crashes causing a reboot of the Domain Controller, when Tripwire Intrusion Detection software is installed on the Domain Controller
The following error is recorded in the Application Event log:
Faulting application name: lsass.exe, version: 6.1.7601.18719, time stamp: 0x54b7622f
Faulting module name: CAADHook.dll_unloaded, version: 0.0.0.0, time stamp: 0x5558072c Exception code: 0xc0000005
Fault offset: 0x00000000662f5891
Faulting process id: 0x338
Faulting application start time: 0x01d09669023859f0
Faulting application path: C:\Windows\system32\lsass.exe
Faulting module path: CAADHook.dll Report Id: 7d55b135-4d0b-11e5-8ce1-bc305bf2c1a0
-
原因
Unknown. -
対策
WORKAROUND:
Reports from our customers have reported success with un-installing and re-installing both the Change Auditor Agent and the Tripwire agent.