戻る
-
タイトル
How does disabling SCMHook impact on event collection? -
説明
What does SCMHook monitor and what are the impacts in disabling it? -
原因
SCMHook use SERVICESHOOK.DLL to collect information regarding the Start and Stop of Services
-
対策
In general, Start and Stop of Services are not recorded, but it can be setup to record using the Services template under View > Administration > Auditing Config > Servers. Unless there is a need to monitor Services status, SCMHook can be disabled as follow:
- Location: Registry
- Path: HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor\Agent
- Value Name: DisableSCMHook
- Value Type: DWORD 32-bit
- 1 - Disable services hook
- 0 - Enable services hook (default)