Change Auditor Agent Causes LSASS.EXE Crash Due to Specific CAADHook.dll Defect (4384803)

Intermittent crashes of LSASS.EXE on systems running the Change Auditor Agent. Crash dump analysis was performed and identified a specific defect within the CAADHook.dll module loaded by the Change Auditor Agent.

The analysis determined that this is a rare fringe-case issue occurring under specific conditions and is not representative of the broader LSASS-related stability issues previously addressed in Change Auditor 7.6.2 and Change Auditor 7.6.3.

Symptoms

The following symptoms may be observed on affected systems:

• LSASS.EXE terminates unexpectedly.
• Domain controllers or monitored servers may become unstable or automatically reboot following the LSASS process termination.
• Windows Application Event Logs may reference:
  • lsass.exe
  • CAADHook.dll
• The issue typically occurs intermittently and can be difficult to reproduce consistently.

This issue has been identified as a product defect and has been logged with the Change Auditor Development team.

Defect ID: 761136

The defect has been fixed and will be included in the Change Auditor 7.7 release.

Workaround

At this time:

• There is no configuration setting available to disable the affected functionality within the Change Auditor Agent.
• There is no supported workaround that allows the specific hook component to be disabled independently.

Recommended Mitigation

Disable or uninstall the Change Auditor Agent from the affected server(s) until a permanent fix becomes available.

Note: Disabling the agent will stop Change Auditor event collection from the affected system. Customers should evaluate the impact on auditing and compliance requirements before implementing this mitigation.