LsaRegisterPolicyChangeNotification() only fires at 5 minute intervals?

From: Chuck Chopp (
Date: 09/26/05

  • Next message: John Banes: "Re: schannel DecryptMessage giving extra junk chars?"
    Date: Mon, 26 Sep 2005 13:00:55 -0400

    When I call LsaRegisterPolicyChangeNotification() to register an event
    handle so that I may receive notification of changes to the auditing
    policies on a server, I'm observing that no matter how many times I manually
    make auditing policy changes, the event is only signaled a single time, and
    the signaling is done at a fixed 5 minute interval.

    For example, if I make a change to the auditing policy, within 5 minutes
    I'll see that my event gets signaled. If I make another change before the
    event is signaled, the time at which the event gets signaled does not
    change. The event will simply be signaled no more often than once every 5

    This behavior is being observed on Win2K3 SP1 configured as the only DC in a
    test AD tree.

    Is this timing interval and the delayed signaling of the notification event
    a documented behavior? I don't see any reference to this behavior in the
    MSDN documentation, nor in the example code that accompanies the docs for
    LsaRegisterPolicyChangeNotification(). I do see that the change in the
    auditing policy takes effect immediately w/respect to what actually gets
    audited, though, so it's not like the delayed notification goes along with a
    delayed application of the audit policy changes.

    I need to find a way to make the notification happen immediately after the
    audit policy change occurs as my application can fail if auditing of certain
    events gets disabled.

    Has anybody else observed this behavior when using this API function?



    Chuck Chopp
    ChuckChopp (at) rtfmcsi (dot) com
    RTFM Consulting Services Inc.     864 801 2795 voice & voicemail
    103 Autumn Hill Road              864 801 2774 fax
    Greer, SC  29651
    "Racing to save lives"
    The Leukemia & Lymphoma Society - Team in Training
    Do not send me unsolicited commercial email.

  • Next message: John Banes: "Re: schannel DecryptMessage giving extra junk chars?"