How does disabling SCMHook impact on event collection? (4307174)

SCMHook use SERVICESHOOK.DLL to collect information regarding the Start and Stop of Services

In general, Start and Stop of Services are not recorded, but it can be setup to record using the Services template under View > Administration > Auditing Config > Servers. Unless there is a need to monitor Services status, SCMHook can be disabled as follow:

• Location: Registry
• Path: HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor\Agent
• Value Name: DisableSCMHook
• Value Type: DWORD 32-bit
• 1 - Disable services hook
• 0 - Enable services hook (default)