Windows 2012 Protected Service enabled for LSASS prevents Change Auditor Agent service deploying/running
After setting Windows Server 2012 "Protected Service" enabled for LSASS, the Change Auditor Agent service deploys but starts and stops after approximately 20 seconds. Once the setting is removed, Change Auditor Agents deploy/work fine.
Currently, Change Auditor does not support "Protected Service" enabled.
Microsoft does not offer any ‘excluded process list’ so there is no workaround. Change Auditor simply cannot work if this technology is enabled at this time.
Enhancement Request TF00388622 has been submitted for this issue.