Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem in my server that the system time is automatically getting changed by a day and getting back to normal. I have some software installed for time sych. But the master clock seem to be fine. So I am suspecting if some other process is changing the time. I have enabled the event logging for time change. But it is not having the process name in it. Is there a way to find the process name that changes the system time in Win-server-2003??

share|improve this question

3 Answers 3

Run

tasklist /svc

on the commandline.

The svchost that hosts W32Time is your culprit.

share|improve this answer

If you suspect an ongoing process that's doing it, you may be able to check it for the SE_SYSTEMTIME_NAME privilege. Process Explorer shows it on the Security tab of process details as SeSystemtimePrivilege, but you'd have to check that on a per-process basis. This may not help if a process is simply launching another process to update system time.

You may be able to work from the code in this Stack Overflow article: http://stackoverflow.com/questions/2094663/determine-if-windows-process-has-privilege-to-create-symbolic-link to run a check for processes that have that privilege.

Also of note on Windows servers you shouldn't need third-party software for time synchronization - you should be able to specify NTP server(s) that the system will automatically sync to; if the server is disconnected from the Internet you should still be able to check against your DCs (if on a domain).

Also of possible interest is the MSDN information on changing system or local time (start from http://msdn.microsoft.com/en-us/library/ms724942%28v=VS.85%29.aspx) or time zone.

share|improve this answer

Is the server part of a domain? Is it a domain controller? In a Windows domain, the PDC emulator is by default the authoritative time server for the domain; all domain members synchronize with the PDC (via the Windows Time Service). The PDC is generally configured to sync with an Internet time source, by default time.windows.com which seems to me to be an unreliable source of time.

To learn more about the Windows Time Service, start here: http://technet.microsoft.com/en-us/library/cc773061(WS.10).aspx

share|improve this answer
    
Just a minor correction, in a multi-site environment all DCs sync with the PDC emulator, and other domain members sync with their closest DC. –  ThatGraemeGuy Nov 8 '11 at 6:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.