Disable event 1 kernel-general in windows 2008 R2

Posted on 2011-05-04
Last Modified: 2012-05-11
Hi Experts,

We desperately need to disable event 1 kernel-general in windows 2008 R2 indicating the system time has changed.

Please advise.

Question by:jimmy1829
    LVL 61

    Accepted Solution

    could you please help with FULL log message from both Windows 2003 and Windows 2008 ?
    i.e open event, press copy button and paste in a text file to attach here.
    Without Event Source mentioned your mention of event 1 kernel-lieutenant is completely useless.

    Author Comment

    Thanks, please see below

    Log Name:      System
    Source:        Microsoft-Windows-Kernel-General
    Date:          13/01/2011 5:37:33 PM
    Event ID:      1
    Task Category: None
    Level:         Information
    Keywords:      Time
    User:          SYSTEM
    Computer:      Database01
    The system time has changed to ¿2011¿-¿01¿-¿13T22:37:33.500000000Z from ¿2011¿-¿01¿-¿13T22:36:33.339397000Z.
    Event Xml:
    <Event xmlns="">
        <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
        <TimeCreated SystemTime="2011-01-13T22:37:33.500000000Z" />
        <Correlation />
        <Execution ProcessID="4" ThreadID="80" />
        <Security UserID="S-1-5-18" />
        <Data Name="NewTime">2011-01-13T22:37:33.500000000Z</Data>
        <Data Name="OldTime">2011-01-13T22:36:33.339397000Z</Data>
    LVL 61

    Expert Comment

    NTP client does it every 6 hours.
    1 minute offset in 6 hours signifies badly damaged hardware (or that your virtualization solution does not keep time correctly)

    What are your time servers? Are your domain controllers in sync?

    Author Comment

    This behaviour seems really random. Sometimes it happens 3 times a day, sometimes it does not happen in 2 weeks.

    This is a physical server, and I have seen this event everywhere even on my Windows 7 machine, which syncs with Internet.
    LVL 61

    Expert Comment

    it is a normal time synching event. "Windows Time" service is responsible for it.

    particular message sets time one minute ahead. That is bad. i would recommend to check (with ntpdate from meinberg NTP if no better idea) if all DCs have same time set.

    This event is a sign of normal operation otherwise. If you filter then say pay attention to offset of >10min or so.

    You can use Meinberg NTP to adjust timer speed in place of default NTP. It will report communication error with upstream NTP anyway.

    Featured Post

    Shouldn't all users have the same email signature?

    You wouldn't let your users design their own business cards, would you? So, why do you let them design their own email signatures? Think of the damage they could be doing to your brand reputation! Choose the easy way to manage set up and add email signatures for all users.

    Join & Write a Comment

    I have been working as System Administrators since 2003. I recently started working as a FreeLancer and was amazed to find out that very few people are taking full advantage of their Windows Server Machines. Microsoft Windows Server comes with so…
    I was asked if I could set up a fax machine so that incoming faxes were delivered to people's Exchange inboxes and so that they could send faxes from their desktops without needing to print the document first.  I knew it was possible but I had no id…
    This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
    This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now