LsaRegisterPolicyChangeNotification() only fires at 5 minute intervals?

From: Chuck Chopp (ChuckChopp_at_rtfmcsi.com)
Date: 09/26/05

  • Next message: John Banes: "Re: schannel DecryptMessage giving extra junk chars?" 
    Date: Mon, 26 Sep 2005 13:00:55 -0400

    When I call LsaRegisterPolicyChangeNotification() to register an event
    handle so that I may receive notification of changes to the auditing
    policies on a server, I'm observing that no matter how many times I manually
    make auditing policy changes, the event is only signaled a single time, and
    the signaling is done at a fixed 5 minute interval.

    For example, if I make a change to the auditing policy, within 5 minutes
    I'll see that my event gets signaled. If I make another change before the
    event is signaled, the time at which the event gets signaled does not
    change. The event will simply be signaled no more often than once every 5
    minutes.

    This behavior is being observed on Win2K3 SP1 configured as the only DC in a
    test AD tree.

    Is this timing interval and the delayed signaling of the notification event
    a documented behavior? I don't see any reference to this behavior in the
    MSDN documentation, nor in the example code that accompanies the docs for
    LsaRegisterPolicyChangeNotification(). I do see that the change in the
    auditing policy takes effect immediately w/respect to what actually gets
    audited, though, so it's not like the delayed notification goes along with a
    delayed application of the audit policy changes.

    I need to find a way to make the notification happen immediately after the
    audit policy change occurs as my application can fail if auditing of certain
    events gets disabled.

    Has anybody else observed this behavior when using this API function?

    TIA,

    Chuck 

    -- 
Chuck Chopp
ChuckChopp (at) rtfmcsi (dot) com http://www.rtfmcsi.com
RTFM Consulting Services Inc.     864 801 2795 voice & voicemail
103 Autumn Hill Road              864 801 2774 fax
Greer, SC  29651
"Racing to save lives"
The Leukemia & Lymphoma Society - Team in Training
http://www.active.com/donate/tntsc/tntscCChopp
Do not send me unsolicited commercial email.
  • Next message: John Banes: "Re: schannel DecryptMessage giving extra junk chars?"

    Relevant Pages

    • [RFC PATCH 01/17] shm-signal: shared-memory signals
      ... This interface provides a bidirectional shared-memory based signaling ... * it under the terms of version 2 of the GNU General Public License ... +struct shm_signal_desc { ... * a locale boundary to inject a remote notification. ...
      (Linux-Kernel)
    • [RFC PATCH v2 01/19] shm-signal: shared-memory signals
      ... This interface provides a bidirectional shared-memory based signaling ... * it under the terms of version 2 of the GNU General Public License ... +struct shm_signal_desc { ... * a locale boundary to inject a remote notification. ...
      (Linux-Kernel)
    • [RFC PATCH v3 01/17] shm-signal: shared-memory signals
      ... This interface provides a bidirectional shared-memory based signaling ... * it under the terms of version 2 of the GNU General Public License ... +struct shm_signal_desc { ... * a locale boundary to inject a remote notification. ...
      (Linux-Kernel)
    • Re: Being notified of user attribute changes
      ... Yeah I know I can do the auditing but the notification is ... You can use auditing of your DCs for account changes for success and ... Active Directory Alerts ...
      (microsoft.public.windows.server.active_directory)
    • Re: monitor file deletion
      ... Again will running task scheduler every 5 minutes and turning ... auditing on will not eat system resoruces. ... then use a Command Line mailer to inform ... >> notification like email as soon as the file is deleted. ...
      (microsoft.public.win2000.general)