Re: LsaRegisterPolicyChangeNotification() only fires at 5 minute intervals?

From: Chuck Chopp (ChuckChopp_at_rtfmcsi.com)
Date: 09/27/05 

Date: Tue, 27 Sep 2005 07:10:36 -0400

Interesting.

Yes, there are a few differences in our testing environments. There's the
DC vs. non-DC issue, and then there's the fact that my code is running as
part of a multi-threaded service. I have one thread dedicated to testing
for audit policy changes, and it pretty much does what your code does with
the exception that it calls WaitForMultipleObjects() and waits on either of
two different events to be signaled. The first event in the two event array
is the one registered for audit policy changes, and the other event is a
"control" event used by the service's main thread to cause all worker
threads to come out of a wait state when the service is being told to stop
or pause itself. One last difference is that my thread also has an open LSA
policy handle in existence the whole time so that it can read the policy
quickly when it does return from WaitForMultipleObjects() due to an audit
policy change notification.

I'll re-test on a non-DC, and re-test with the LSA policy handle closed to
see if those changes make a difference in the 5 minute interval. 

-- 
Chuck Chopp
ChuckChopp (at) rtfmcsi (dot) com http://www.rtfmcsi.com
RTFM Consulting Services Inc.     864 801 2795 voice & voicemail
103 Autumn Hill Road              864 801 2774 fax
Greer, SC  29651
"Racing to save lives"
The Leukemia & Lymphoma Society - Team in Training
http://www.active.com/donate/tntsc/tntscCChopp
Do not send me unsolicited commercial email.