LsaRegisterPolicyChangeNotification() only fires at 5 minute intervals?
From: Chuck Chopp (ChuckChopp_at_rtfmcsi.com)
Date: Mon, 26 Sep 2005 13:00:55 -0400
When I call LsaRegisterPolicyChangeNotification() to register an event
handle so that I may receive notification of changes to the auditing
policies on a server, I'm observing that no matter how many times I manually
make auditing policy changes, the event is only signaled a single time, and
the signaling is done at a fixed 5 minute interval.
For example, if I make a change to the auditing policy, within 5 minutes
I'll see that my event gets signaled. If I make another change before the
event is signaled, the time at which the event gets signaled does not
change. The event will simply be signaled no more often than once every 5
This behavior is being observed on Win2K3 SP1 configured as the only DC in a
test AD tree.
Is this timing interval and the delayed signaling of the notification event
a documented behavior? I don't see any reference to this behavior in the
MSDN documentation, nor in the example code that accompanies the docs for
LsaRegisterPolicyChangeNotification(). I do see that the change in the
auditing policy takes effect immediately w/respect to what actually gets
audited, though, so it's not like the delayed notification goes along with a
delayed application of the audit policy changes.
I need to find a way to make the notification happen immediately after the
audit policy change occurs as my application can fail if auditing of certain
events gets disabled.
Has anybody else observed this behavior when using this API function?
-- Chuck Chopp ChuckChopp (at) rtfmcsi (dot) com http://www.rtfmcsi.com RTFM Consulting Services Inc. 864 801 2795 voice & voicemail 103 Autumn Hill Road 864 801 2774 fax Greer, SC 29651 "Racing to save lives" The Leukemia & Lymphoma Society - Team in Training http://www.active.com/donate/tntsc/tntscCChopp Do not send me unsolicited commercial email.