Disable event 1 kernel-general in windows 2008 R2

Posted on 2011-05-04
Medium Priority
Last Modified: 2012-05-11
Hi Experts,

We desperately need to disable event 1 kernel-general in windows 2008 R2 indicating the system time has changed.

Please advise.

Question by:jimmy1829
  • 3
  • 2
LVL 62

Accepted Solution

gheist earned 2000 total points
ID: 35696575
could you please help with FULL log message from both Windows 2003 and Windows 2008 ?
i.e open event, press copy button and paste in a text file to attach here.
Without Event Source mentioned your mention of event 1 kernel-lieutenant is completely useless.

Author Comment

ID: 35703189
Thanks, please see below

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          13/01/2011 5:37:33 PM
Event ID:      1
Task Category: None
Level:         Information
Keywords:      Time
User:          SYSTEM
Computer:      Database01
The system time has changed to ¿2011¿-¿01¿-¿13T22:37:33.500000000Z from ¿2011¿-¿01¿-¿13T22:36:33.339397000Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <TimeCreated SystemTime="2011-01-13T22:37:33.500000000Z" />
    <Correlation />
    <Execution ProcessID="4" ThreadID="80" />
    <Security UserID="S-1-5-18" />
    <Data Name="NewTime">2011-01-13T22:37:33.500000000Z</Data>
    <Data Name="OldTime">2011-01-13T22:36:33.339397000Z</Data>
LVL 62

Expert Comment

ID: 35706051
NTP client does it every 6 hours.
1 minute offset in 6 hours signifies badly damaged hardware (or that your virtualization solution does not keep time correctly)

What are your time servers? Are your domain controllers in sync?

Author Comment

ID: 35706848
This behaviour seems really random. Sometimes it happens 3 times a day, sometimes it does not happen in 2 weeks.

This is a physical server, and I have seen this event everywhere even on my Windows 7 machine, which syncs with Internet.
LVL 62

Expert Comment

ID: 35707007
it is a normal time synching event. "Windows Time" service is responsible for it.

particular message sets time one minute ahead. That is bad. i would recommend to check (with ntpdate from meinberg NTP if no better idea) if all DCs have same time set.

This event is a sign of normal operation otherwise. If you filter then say pay attention to offset of >10min or so.

You can use Meinberg NTP to adjust timer speed in place of default NTP. It will report communication error with upstream NTP anyway.

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For anyone that has accidentally used newSID with Server 2008 R2 (like I did) and hasn't been able to get the server running again because you were unlucky (as I was) and had no backups - I was able to get things working by doing a Registry Hive rec…
Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question