I've written a custom password filter for Windows Domain Controllers (a passfilt.dll) and registered it according to the instructions (put it in the system32 folder and updated the registry key)
But there are no signs of the DLL even being called. None.
I've set up auditing of system events and I'm getting 4614 events ("A notification package has been loaded by the Security Account Manager.") for scecli and rassfm, both listed in "HKEY_LOCAL_MACHINE.SYSTEM.CurrentControlSet.Control.Lsa.Notification Packages". If I remove them from "Notification Packages", they're not read. As expected. But the DLL that I've put into "Notification Packages" is not loaded. Nor is the logged a failed audit. Or any other event. The DLL is not loaded since I can delete it without a lock.
The OS is Windows 2008 R2 x64 and I'm using an 64 bit version of my DLL.
Does anyone have an idea on how I should proceed to solve this problem? At least find an error message or something...