Voltar
-
Título
How does disabling SCMHook impact on event collection? -
Descrição
What does SCMHook monitor and what are the impacts in disabling it? -
Causa
SCMHook use SERVICESHOOK.DLL to collect information regarding the Start and Stop of Services
-
Resolução
Unless there is a need to monitor Services status, SCMHook can be disabled as follow:
- Location: Registry
- Path: HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor\Agent
- Value Name: DisableSCMHook
- Value Type: DWORD 32-bit
- 1 - Disable services hook
- 0 - Enable services hook (default)
This can be used in cases where the Change Auditor Agent is not starting as in KB 147332