ADUC Not Responding When Making Changes to Protected Object

Just installed Change Auditor 6.9.3 on a new domain.

I have set a few Protection Templates setup on the domain to protect groups and a couple of OUs.

One of them is set to protect an OU from Create, Modify, Delete & Move.

When I test creating a new OU under the protected OU object, ADUC freezes and gives no warning that the action is not allowed. The ADUC process must be killed to proceed. Is this normal? The alert shows up in the logs however, no email alert is sent/received.

Is there a way to set an email alert on the Protection Template itself when it generates the alert? I don't see this option. It only exists on the alerts themselves.

I also tested renaming a protected OU object and ADUC freezes up then too. Is the agent causing this or am I missing some config settings?



A problem caused this program to stop interacting with Windows.

Problem signature:

Problem Event Name: AppHangB1

Application Name: mmc.exe

Application Version: 6.3.9600.17415



Thanks, Fred.

  • Hi Fred,

    This is recently discovered issue which is addressed in coming 6.9.4 release:

    Issue ID:9497
    Active Directory Users and Computers snap-in hangs when modifying membership of a group
    protected by Change Auditor if Microsoft Update KB022726 is installed on Domain Controllers.

    Change Auditor 6.9.4 will be available at the download link below within the next few days:

    I'll update the thread once I see it available.

  • In reply to Chris.Hood:

    Thanks Chris,
    I'll look for the update in the next few days.

    Do you have a suggestion on my question about sending an alert email when a Protection Template triggers an event?

    Thank you, Fred.
  • In reply to pfg:

    Hi Fred,

    On the search in question select the WHAT tab, click the down arrow by the ADD button and click 'Result...'. Finally, add 'Protected' to the search criteria. This will filter your search/alert results for only events pertaining to attempted modifications to protected objects.

  • In reply to Chris.Hood:

    Hi Fred,

    Change Auditor 6.9.4 is now available at the link provided previously.