Cannot find DRSGetNCChanges - 'Irregular domain replication activity detected' event (4375720)

Cannot find DRSGetNCChanges - 'Irregular domain replication activity detected' event

After May 14th, 2024, the Change Auditor agent is not working on a Domain Controller running Windows Server 2022 and there are Cannot find DRSGetNCChanges - 'Irregular domain replication activity detected' events.

The Windows update for May 14th 2024 appears to have caused a broken hook on 2022 DC- 'Cannot find DRSGetNCChanges' which affects the 'Irregular domain replication activity detected' Change Auditor event

Example from CAADHook.dll.nptlog (see log attached):

ID: 243
Time: 5/14/24 17:51:20.267
Level: WARN
Thread: 5568
Logger: Root Logger
File: c:\build\1\s\product\itad\qcmhook\hooks\logon\drsgetncchangeshook.cpp
Function: CHookDRSGetNCChangesImpl::FindDRSGetNCChangesFnAddress
Line: 683
Message: Cannot find IDL_DRSGetNCChanges, Windows server verion: 9;

ID: 244
Time: 5/14/24 17:51:20.267
Level: WARN
Thread: 5568
Logger: Root Logger
File: c:\build\1\s\product\itad\qcmhook\hooks\hookmgr.hpp
Function: CHookMgrImpl::Update
Line: 373
Message: Cannot find DRSGetNCChanges.

WORKAROUND:

Uninstall all the Security Updates that were installed on May 14th, 2024 in the affected DC.

SOLUTION:

The Product team logged Defect ID 492548 and is currently evaluating the implementation of a fix on the next Change Auditor release.

492548

Product Defect ID 492548