(CNN) -- Virginia Tech violated federal campus security law when it waited too long to inform students about a shooter on the loose during a 2007 rampage that killed 32 people, the U.S. Department of Education says in a new report.
The report, released Thursday, says the school did not notify students in a "timely manner" -- as dictated by the Clery Act -- of a dorm-room shooting that left two people dead on the morning of April 16, 2007.
The same shooter, identified as 23-year-old Cho Seung-Hui, went to the university's Norris Hall more than two hours later and killed 30 more people before turning the gun on himself.
The Clery Act was created in 1990 in memory of 19-year-old Jeanne Ann Clery, who was raped and killed while asleep in her dorm room at Lehigh University. The law requires colleges and universities to disclose information about crimes on or near their campuses.
According to the report, police went to the scene of the Virginia Tech dorm shooting at 7:24 a.m on April 16.
At 7:57 a.m. police notified the office of the executive vice president about the shooting.
But it was not until 9:26 a.m. that the university first notified students and staff by e-mail about the shooting.
It was about 20 minutes after the e-mail went out that Cho opened fire in Norris Hall.
"The warnings that were issued by the university were not prepared or disseminated in a manner to give clear and timely notice of the threat to the health and safety of campus community members," the report said.
A preliminary report, released in May by the Department of Education, came to the same conclusion.
University officials from Virginia Tech disputed that report.
"Virginia Tech professionals acted appropriately in their response to the tragic events of April 16, 2007, based on the best information then available to them," the university said then in its response.
Education Secretary Arne Duncan, released a message Thursday to the victim's of the shooting.
"My heart goes out to the families of those who lost loved ones during the tragic events of April 16, 2007, and to the entire Virginia Tech community," Duncan said. "While Virginia Tech failed to adequately warn students that day, we recognize that the university has put far-reaching changes in place since that time to help improve campus safety and better protect its students and community."
CNN's Scott Thompson contributed to this report