Disable event 1 kernel-general in windows 2008 R2

Hi Experts,

We desperately need to disable event 1 kernel-general in windows 2008 R2 indicating the system time has changed.

Please advise.

Thanks,
jimmy1829Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

 
gheistCommented:
could you please help with FULL log message from both Windows 2003 and Windows 2008 ?
i.e open event, press copy button and paste in a text file to attach here.
Without Event Source mentioned your mention of event 1 kernel-lieutenant is completely useless.
0

Experts Exchange Solution brought to you by ConnectWise

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
 
jimmy1829Author Commented:
Thanks, please see below

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          13/01/2011 5:37:33 PM
Event ID:      1
Task Category: None
Level:         Information
Keywords:      Time
User:          SYSTEM
Computer:      Database01
Description:
The system time has changed to ¿2011¿-¿01¿-¿13T22:37:33.500000000Z from ¿2011¿-¿01¿-¿13T22:36:33.339397000Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>1</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2011-01-13T22:37:33.500000000Z" />
    <EventRecordID>9677</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="80" />
    <Channel>System</Channel>
    <Computer>YMDB02</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="NewTime">2011-01-13T22:37:33.500000000Z</Data>
    <Data Name="OldTime">2011-01-13T22:36:33.339397000Z</Data>
  </EventData>
</Event>
0
 
gheistCommented:
NTP client does it every 6 hours.
1 minute offset in 6 hours signifies badly damaged hardware (or that your virtualization solution does not keep time correctly)

What are your time servers? Are your domain controllers in sync?
0
 
jimmy1829Author Commented:
This behaviour seems really random. Sometimes it happens 3 times a day, sometimes it does not happen in 2 weeks.

This is a physical server, and I have seen this event everywhere even on my Windows 7 machine, which syncs with Internet.
0
 
gheistCommented:
it is a normal time synching event. "Windows Time" service is responsible for it.

particular message sets time one minute ahead. That is bad. i would recommend to check (with ntpdate from meinberg NTP if no better idea) if all DCs have same time set.

This event is a sign of normal operation otherwise. If you filter then say pay attention to offset of >10min or so.

You can use Meinberg NTP to adjust timer speed in place of default NTP. It will report communication error with upstream NTP anyway.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.