Virtual Domain Controller Windows server 2k8 R2 timer change by "User: System" "UserID=S-1-5-18"

[cwb2000]

The Windows server 2k8 R2 is a domain controller & virtual machine reside on VMWare ESXi 4.1.0 and some are VMWare ESXi 4.0.0 . The setting is Virtual Machine didn't sync time to ESXi host, and ESXi host is also not part of domain. But we did run a script from domain controller to manually sync ESXi host with domain controller. How we run the script can see from the related topic. http://communities.vmware.com/message/1771206#1771206 Not sure does it cause the windows time crash?

Now we found a interesting problem after we manually adjust windows time or running a task to sync domain controller to high level web service inside our system, from event log we can see "User: System"  "UserID=S-1-5-18" change the window timer one more time. The event happen about 20~60min later, everytime it is different on different site. We don't know what trig this event & which task is doing this. Here I attach event log below.

Log Name:      System

Source:        Microsoft-Windows-Kernel-General

Date:          12/07/2011 8:43:38 PM

Event ID:      1

Task Category: None

Level:         Information

Keywords:      Time

User:          SYSTEM

Computer:      XXXXXXXX.com

Description:

The system time has changed to ‎2011‎-‎07‎-‎12T11:13:38.500000000Z from ‎2011‎-‎07‎-‎12T11:17:57.796875000Z.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />

    <EventID>1</EventID>

    <Version>0</Version>

    <Level>4</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8000000000000010</Keywords>

[Rumple]

anytime the Windows time service makes changes to the time on the system it will make that event.  

So..with a VM, when the windows time service gets CPU cycles it will cause this event to occur (since a VM will time drift because of CPU scheduling).

I see it all the time on my VM which also uses vmware tools to sync the time...

Bloody annoying but doesn't seem to cause any issues...

[cwb2000]

Hi Thanks Mark,

The problem is we cancel the time sync between VM & ESXi host. And this happen to change the windows clock will crash our application running which relied on the correct time stamp. Now it is a big problem for us, ☹

This is from .VMX file:

svga.vramSize = "8388608"

tools.syncTime = "FALSE"

uuid.location = "56 4d f8 71 9d 4b 81 d9-2a f6 73 20 ba c7 df 9d"

cleanShutdown = "FALSE"

And the setting of VM as below:

[Rumple]

Then you may have to resign yourself to the fact that your application is not suited to a virtualization environment as it will never be running 100% of the time (even for millisends at a time) and will always be playing catchup on the time

[cwb2000]

Hi, our application has 5 minutes range, but we don't know sometimes it changes 1 min but sometimes change 4 mins then we got problem. And this is not happen all the time.

[chriswahl]

Make sure to check the tools icon in the guest's tray to ensure the "time sync" box isn't checked.

I prefer to have the PDCe DC sync with the atomic clock in Colorado (but this could be any reliable time source you trust), and then all level 4 DCs (non PDCe basically) use domhier w32tm sync to that one. Non DCs sync to the level 4's.

domhier time sync is done in real time and uses a "drift" method to stripchart against other DCs and make fine tuned adjustments until the difference is within tolerance.

More details:

http://technet.microsoft.com/en-us/library/cc758905(WS.10).aspx

[cwb2000]

Thanks Chris,

Our DC & system is more like a stand-alone system means we don't have any internet or external network connection. The only connection is the time sync & service request to high level system. And our problem now more focus on why & which windows or ESXi service will jump up randomly to change the windows system time. It is quite risky in the system because we don't know when it will pop up & change the time out of range then crash the application. Thanks!

[chriswahl]

On your DC that is having the issue:

1. Determine what it is using as an ntp server.
2. From an admin command prompt, run
3. w32tm /stripchart /computer:<name of sync target>

This will tell you how far off it is from the ntp server.

If you don't know the ntp server or want to set it anyway, set a manual peer and disable domain hierarchy sync

1. open an admin command prompt
2. w32tm /config /manualpeerlist:<dns of ntp server> /syncfromflags:manual
3. w32tm /config /update
4. w32tm /resync /rediscover

The time will not instantly sync, it will update in small increments (usually 1/2 a millisecond per second) until it's synced. You can watch this with the stripchart command (step 3 at top).

[cwb2000]

Hi Chris,

We don't have any NTP settings now. We sync time with web service of internal higher level system 3:10AM once per day.

[chriswahl]

Sounds like that's the problem then.

[cwb2000]

I don't understand that seems like domain controller doesn't work without NTP server?

[Rumple]

Active directory required a time source to be accurate. When time gets out of sync, your credentials break due to security built into Kerberos…

Windows can get its time from somewhere (say the ESX Host), however anything AD related must also be in sync with that time. All other systems need to talk to the Time Service on the DC’s to validate they are also in sync.

[chriswahl]

What Rumple said.

Basically I think this is a design issue with your AD structure, not something VMware related.

[cwb2000]

Thanks Rumple,

We believe this issue must trigger by either ESXi host or time service within Windows DC, probably W32time. Our system run about one year never has this problem.

Why we think we need sync the host with virtual machine - domain controller because after long time not sync, the time gap between host & virtual machine became bigger & bigger. When we apply any new application change on virtual machine (domain controller) & reboot the machine we will get time from host then fail the daily time sync to internal higher system since big time gap. Then we decide to manually sync ESXi host time with virtual machine. To do this, we schedule a task to run a script which force host to accept time change. Since from this change, the time will change by "system" from time to time, specially after we sync DC with higher system & get a big time change like 2 mins, then we force ESXi host to change the time as well.