This Question is Answered
1 "helpful" answer available (6 pts)
5 Replies
Last post:
Apr 16, 2009 11:05 AM by
GFFG
At a previous company, the Windows group had a similar question and we did the following:
I'm not sure if it's a best practice to sync your VM(s) to your ESX/ESXi host and then have that sync to your external time source, it may be up for interpretation, though our Windows team felt they wanted to directly sync the VM(s) to our AD/external source since they're all connected to the domain. We disable the sync from VM to host, but we do also sync our NTP Client settings on our ESX hosts to our internal NTP server. The reason for the sync is that we also have our Service Console not only authenticate to admin account locally but we also have it talk to AD so that VI Admins can also login using their AD credentials and we only keep one local admin account for the UNIX/Linux group for administrating the host. As you're probably aware, directory services/AD is very time sensitive and you want to make sure you're not drifting too far apart, else the system won't allow you to logon and we felt that it should not rely on the host for the time in case the host loses it's sync so we have two NTP sources.
Hopefully this helps out
=========================================================================
William Lam
VMware vExpert 2009
VMware ESX/ESXi scripts and resources at: http://engineering.ucsb.edu/~duonglt/vmware/
http://twitter.com/lamw
I'm not sure if it's a best practice to sync your VM(s) to your ESX/ESXi host and then have that sync to your external time source, it may be up for interpretation, though our Windows team felt they wanted to directly sync the VM(s) to our AD/external source since they're all connected to the domain. We disable the sync from VM to host, but we do also sync our NTP Client settings on our ESX hosts to our internal NTP server. The reason for the sync is that we also have our Service Console not only authenticate to admin account locally but we also have it talk to AD so that VI Admins can also login using their AD credentials and we only keep one local admin account for the UNIX/Linux group for administrating the host. As you're probably aware, directory services/AD is very time sensitive and you want to make sure you're not drifting too far apart, else the system won't allow you to logon and we felt that it should not rely on the host for the time in case the host loses it's sync so we have two NTP sources.
Hopefully this helps out
=========================================================================
William Lam
VMware vExpert 2009
VMware ESX/ESXi scripts and resources at: http://engineering.ucsb.edu/~duonglt/vmware/
http://twitter.com/lamw
Yes this was a decision from our Windows team that they wanted to sync directly to Windows time source and all Window images were setup to not sync with host. I don't believe we ever had our Window VM(s) sync to the host, it was sort of something that was there for awhile. Hope this helped
=========================================================================
William Lam
VMware vExpert 2009
VMware ESX/ESXi scripts and resources at: http://engineering.ucsb.edu/~duonglt/vmware/
http://twitter.com/lamw
=========================================================================
William Lam
VMware vExpert 2009
VMware ESX/ESXi scripts and resources at: http://engineering.ucsb.edu/~duonglt/vmware/
http://twitter.com/lamw