Join Log in
Score:0
RobC_CTL avatar Server

Both LOCAL SERVICE and SYSTEM users are changing server time on DC

cn flag
RobC_CTL

Odd one for you, our DC's time keeps changing by an hour, but it doesn't just go down by an hour it also go up. I've been monitoring the event logs and I can see that there are usually two entries close to each other than both have changed the time. One of them the user is LOCAL SERVICE and the other is SYSTEM.

The server is a Windows 2012 server running as a DC hosted on a EXSi host, VM time sync function is disabled. The server (Dell R530) had an issue with the CMOS battery but that has been replaced so I am confident that is good.

This is a typical days worth of events:

enter image description here

So if we look at the 04:02 entry I can see that LOCAL SERVICE changed the time to 03:02 from 04:02 (1 hour reduction)

enter image description here

Then about 11 minutes later there is another event, this time run under SYSTEM that changes the time again from 02:12 to 03:11 so it has increased by an hour (I am assuming the reason for the mixed up times is because the system time changes and the log then logs at the new time)

enter image description here

Just to confirm that W32TM is configured correctly (We have to use time.windows.com due to firewall configuration)

enter image description here

W32TM Configuration

enter image description here

If anyone can shed some light why I've got two processes setting the time and basically fighting each other that would be great.

35
1 + 1
cn flag
Greg Askew
In the event for the change by LocalService, it provides the process Id. You need to correlate that process Id with the process running on your system to localize it to the offending service that is changing the time.
0
Reply
Score:0
RobC_CTL avatar Server
cn flag
RobC_CTL

Thanks Greg.

After some digging I found the culprit to be the backup process. I found a old Veeam KB article that referenced VMWare and the snapshot process could affect the system time. After killing the VMTools service on the server it has stopped the time jumping around. The host is being moved to Hyper-V soon so this workaround will work for the short term.

+ 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.