The Change Auditor agent is causing the Domain Controller to hang while hooking to LSASS after the MSFT March 2026 updates (4382691)

In some circumstances and environments, after installing the latest Microsoft March 2026 updates, the Domain Controller running the Quest Change Auditor (QCA) Agent is hung while the service is running and tries to hook into LSASS.

A change made by Microsoft to a low-level function in March 2026 Windows updates impacted a QCA agent module on DCs

The product team is aware of the situation, and they have logged the product defect ID 621984. A fix is expected to be available in the 7.6.2 release that has a ETA on mid-April 2026.

WORKAROUND:

1. Stop the Quest Change Auditor agent service
2. Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor\Agent
3. Edit or Create DWORD DisableNtlmHook (case sensitive)
4. Value set to 1
5. A reboot of the host will be required twice to ensure the NTLM hook becomes disabled. Then allow the agent service to auto-start.

Disclaimer: Quest does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to the Microsoft website.

Please be aware of what it means to temporarily disable the NTLM hook in the QCA agent component:

The following events related to NTLM will not be logged by QCA: