BSOD on Windows Server 2012 with Hyper-V and Quest Change Auditor

Recently one of our clustered Hyper-V Hosts (with Windows Server 2012 Datacenter installed) was throwing a BSOD in the moment we tried to delete an ISO file from a CSV Volume.

After investigation with Microsoft Support, we found out that Quest Change Auditor (like McAfee Antivirus) is installing a Filter Driver. This Filter Driver is being used in order to track File Access. 

This Filter Driver in combination with the CSVFS (csvfs.sys) is causing the BlueScreen.
After we uninstalled ChangeAuditor, the problem was solved.

Best Regards,



I'm a Systems Engineer working for an IT-Service Provider in Frankfurt am Main, Germany. I am specialized in Virtualization, High Availability, Storage- and Server Administration. In my free time, I like spend time with my lovely wife, to do sports like jogging and biking. I enjoy movies and a good bottle of fermented grape juice.

Tagged with: , , , ,
Posted in BSOD, Server, Virtualization, Windows Server 2012
One comment on “BSOD on Windows Server 2012 with Hyper-V and Quest Change Auditor
  1. Oh yes, this is “normal” for ChangeAuditor, because the technology is very unstable and I’ve seen other people having the same issues (one is even documented in Quest’s KB article: It’s very unpredictable, and can happen at anytime, because they use undocumented OS hooking technique that can break with any new service pack or even a minor OS patch (read: every “Patch Tuesday”).

    If you need a safer alternative to Quest Change Auditor, you can look at our Netwrix Auditor (, which an auditing solution like Quest’s, but it does not use unsafe technologies that can cause Blue Screens of Death or other critical OS failures.

    P.S. Full disclaimer: I work for Netwrix.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: