0

Odd one for you, our DC's time keeps changing by an hour, but it doesn't just go down by an hour it also go up. I've been monitoring the event logs and I can see that there are usually two entries close to each other than both have changed the time. One of them the user is LOCAL SERVICE and the other is SYSTEM.

The server is a Windows 2012 server running as a DC hosted on a EXSi host, VM time sync function is disabled. The server (Dell R530) had an issue with the CMOS battery but that has been replaced so I am confident that is good.

This is a typical days worth of events:

enter image description here

So if we look at the 04:02 entry I can see that LOCAL SERVICE changed the time to 03:02 from 04:02 (1 hour reduction)

enter image description here

Then about 11 minutes later there is another event, this time run under SYSTEM that changes the time again from 02:12 to 03:11 so it has increased by an hour (I am assuming the reason for the mixed up times is because the system time changes and the log then logs at the new time)

enter image description here

Just to confirm that W32TM is configured correctly (We have to use time.windows.com due to firewall configuration)

enter image description here

W32TM Configuration

enter image description here

If anyone can shed some light why I've got two processes setting the time and basically fighting each other that would be great.

Improve this question
1
  • In the event for the change by LocalService, it provides the process Id. You need to correlate that process Id with the process running on your system to localize it to the offending service that is changing the time.
    – Greg Askew
    May 18, 2023 at 19:54

1 Answer 1

Reset to default
0

Thanks Greg.

After some digging I found the culprit to be the backup process. I found a old Veeam KB article that referenced VMWare and the snapshot process could affect the system time. After killing the VMTools service on the server it has stopped the time jumping around. The host is being moved to Hyper-V soon so this workaround will work for the short term.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .