1

I have a network with the following:

  1. Windows 2003 (PDC Emulator) (in the process of migrating)
  2. Windows 2003 DC (same)
  3. Windows 2008 Hyper-V Host w/ 5 VMs, one VM is a DC, soon to be the PDC Emulator
  4. Windows 2008 Hyper-V Host w/ 2 VMs, remote site, one VM is a DC
  5. Windows 2012 Hyper-V Host w/ 3 VMs, remote site, one VM is a DC

Time sync is set up for all VMs. What I am witnessing is that for the DC on #4, the time is off every morning by 1-2 minutes. The other VMs, hosts, and DCs seem to be fine.

The time server for the 2003 DCs is time.windows.com. The time server for the VM hosts is the DC for each site. (I did not configure them specifically. Each seems to have defaulted to that.) The time server on each VM shows as "VM IC Time Synchronization Provider".

Quite simply, what should each machine be for their time servers, and why are the one VM host, and VMs encountering such an offset, while none of the others are?

  • Please stop calling things 'pdc, or bdc' They are all just domain controllers. There hasn't been a 'BDC' since nt4 days over 15 years ago. – Zoredache May 7 '15 at 22:56
  • 1
    IMO, the Hyper-V Time Synchronization service should be disabled for all domain joined VM's. The PDCe should be synched with an external time provider and all the other domain joined VM's and the Hyper-V hosts should sync with the domain hierarchy. I had several conversations with Microsoft PSS about this very subject and that's what they ultimately recommended to me. I haven't had a time problem since. Note that ONLY the PDCe should sync with an external time source. All other DC's should sync with the domain hierarchy. – joeqwerty May 7 '15 at 23:04
1

The time server on each VM shows as "VM IC Time Synchronization Provider".

Per the Microsoft docs. The DC VMs should be configured to NOT use the integration service for time sync.

If you don't disable this, you can get to a point where your Hypervisor OS will try to sync with the DC it is hosting, and the DC will sync with the hypervisor it is hosted on via the integration service. With no outside source of time, both the host and guest DC will become inaccurate.

Ref: link

Time service For virtual machines that are configured as domain controllers, it is recommended that you disable time synchronization between the host system and guest operating system acting as a domain controller. This enables your guest domain controller to synchronize time from the domain hierarchy. To disable the Hyper-V time synchronization provider, shut down the VM and clear the Time synchronization check box under Integration Services.

  • Assuming this is the case, why aren't the other domain controllers and subsequent VMs also lagging? – user55390 May 8 '15 at 13:09
  • because they aren't syncing with themselves, or their internal clocks are better at keeping time. Anyway feel free to ignore my suggestion why the problem may be happening for you. But the best practice recommendations from Microsoft are quite clear. DCs should be configured to not use the Integration services for time sync. – Zoredache May 8 '15 at 18:35
  • Asking a question as to the root cause of an inconsistency is hardly an indictment of the accuracy of the suggestion. Personally, I'm curious why the option to sync via the VM IC is even offered if it isn't a "best practice". – user55390 May 11 '15 at 3:18
  • I don't know the answer to that. I suspect we would need a Microsoft engineer or Hyper-V expert for that one. – Zoredache May 11 '15 at 3:20
  • On your advice, I disabled the VM IC sync on all VMs. Each domain controller host is syncing to its own DC. For example, VM1 hosting DC1 is syncing to DC1.domain, VM2 is syncing to DC2.domain, etc. For the time being, all of the DCs, VMs, and hosts across the domain are in sync. – user55390 May 11 '15 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.