Replication Increased by ANNOUNCE_IMMEDIATE Events (154502)

MORE INFORMATION

Security account manager (SAM) and local security authority (LSA) replication can fall into a number of categories, including immediate (or urgent) replication. Most replication handled by the Net Logon service occurs at set intervals, but certain types of account or policy changes are considered urgent and must be handled immediately, causing an ANNOUNCE_IMMEDIATE event to be generated and acted upon by the primary domain controller (PDC). The following replications are considered urgent:

• Changing the account lockout policy.
• Changing the domain password policy.
• Changing the password on a machine account.
• Replicating a newly locked-out account.
• Changing an LSA secret (essentially the "trusting" side of changing the machine account password).

These changes are immediate by necessity. For example, if a workstation were to change its machine account password and then lose its connection to its domain controller, it would not be able to connect to any other domain controller until the replication occurred.

As a part of Windows NT security, machine account passwords are changed every seven days. As a side effect of this automatic machine account password change, a domain with a large number of computers and domain controllers may cause replication to occur on a frequent basis.

Some administrators may want to disable these automatic machine account password changes. For information about how to disable automatic machine account password changes, please see the following article in the Microsoft Knowledge Base:

154501How to Disable Automatic Machine Account Password Changes