[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Time Zone, Server Clocks, VMWare, Virtual Machines.

Posted on 2014-01-02
14
Medium Priority
?
1,662 Views
Last Modified: 2014-01-22
Hey Team....

Here is the problem Occasionally say once a month or so, the Domain controller clocks, (and the all the Server Clients and Workstation CLients) adjust their system time by 3 hours (moves forward).

So if the server is in the eastern time zone, and this issue occurs, the clock will move forward by 3 hours. If its suppoed to be 8:00 PM Pacific, it will show 11:00 PM, for eastern the same thing.

The only way to fix the issue is to restart the windows time service on all domain controllers. The issue only seems to affect the VM Domain Controllers

This causes logins to the domain to intermittently fail, once the time service is restarted on all the domain controllers, then the tiume corrects itself and the (logon issue) goes away.

What I have checked so far:

1) All servers have the correct time zone set, for the timezone the server is physically in.
2) None of the servers (domain controllers) are syncing their time to the VMWare host
3)The NTP servers for each of the Windows Domains (there are many windows domain that this same issues occurs on) - are all correct and the time service is working.

Any ideas? on this? I really dont understand what is happening here. When the issue occurs every domain controller, regardless of timezone has its clocks moved forward by 3 hours.

Thanks

Robert
0
Comment
Question by:castellansolutions
  • 6
  • 4
  • 2
  • +2
14 Comments
 
LVL 36

Expert Comment

by:Seth Simmons
ID: 39752311
do the guests have vmware tools installed?
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 39752353
Yes all guests have VMWare tools installed
0
 
LVL 19

Assisted Solution

by:vmwarun - Arun
vmwarun - Arun earned 1332 total points
ID: 39752378
The way time sync should work is your Active Directory clients should sync with the Domain Controller which has the PDC Emulator FSMO role. The PDC emulator should sync with a trusted NTP source.

This article should be helpful in understanding how time sync works in VMware
http://goo.gl/xUh8P2
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
LVL 42

Assisted Solution

by:Paul Solovyovsky
Paul Solovyovsky earned 668 total points
ID: 39752387
If the servers are virtual they'll first get their time from the ESXi hosts so make sure you have them pointed to a NTP source.  What happens with nodes that connect to a domain controller is that even when they finally pick up the correct time from the domain controller the system sees the time difference and may have problems logging in.

I would recommend setting your domain controllers (if physical) to NTP source and then the ESXi hosts to the same source.  This will ensure that all the hosts and nodes get the same time.
0
 
LVL 19

Expert Comment

by:vmwarun - Arun
ID: 39752395
Offtopic - Good to see you answer, Paul.
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 39752779
well apparently esx07 was using the BIOS for its time source and not our time server. i dont know if thats really the iussue. BEucase were not talking about a time skew of a few minutes were talking about 3 hours off all of the sudden. with no reboots of any of the Virtaul machines.

So this case will need to stay open for a while.
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 39752788
Arun,

I did review the link you provided but am still unclear, should i or should i not - have the windows domain controllers sync their clocks to the VM host clocks?
Thanks,

Robert
0
 
LVL 19

Accepted Solution

by:
vmwarun - Arun earned 1332 total points
ID: 39752799
Never sync an AD domain controller's time to an ESXi host. The best way would be to sync with a dedicated NTP server in your environment or better sync the DC with the Internet time servers.

AD clients sync time with DC (PDC Emulator to be specific) -> PDC Emulator in-turn should sync time with an external NTP server such as servers listed on the URL, http://www.pool.ntp.org/en/
0
 
LVL 124
ID: 39753259
We setup our TIME as follows:-

1. Sync ESXi Host time with Internal Tim Server (if you do not have one, Internet Time Source is acceptable).

2. Sync Domain Controller PDC emulator with same time source as 1.

3. ALL VMs (Windows) will time sync with domain e.g. 2 above.

4. Linux VMs we Time Sync with 1 above.

5. Disable VMware Tools Sync Time with Host!
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 39754297
Arun/Andrew

Ok. So here is the deal. None of the domaain controllers were set to sync with the ESX Host, However as mentioned before one of the ESX Hosts didnt have the correct time, and also had no NTP setup. We fixed that and the time corrected itself on the ESX Host.

My question is if the DCs werent rebooted and since were not using any snapshots of the DCs themselves how did the time get set incorrectly on the DCs ?

You may not have enough info to answer that, and i do think we got the issue resolved, i just want to be sure its fixed.

But thanks becuase at least now we've made progress.
0
 
LVL 124
ID: 39754491
1. DCs synced with the Host

2. DCs syned with another time source which was incorrect.
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 39767036
Well so far no issues with this. I would like to keep this open a little longer in case the issue re-occurs (As it has done in the past).

Robert
0
 
LVL 19

Expert Comment

by:vmwarun - Arun
ID: 39767085
Great. Please keep us updated and let us know in case you require more help.
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 39800625
This issue seems to be resolved!! Thanks for your help that VMWare server was killing the whole domain.
0

Featured Post

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When rebooting a vCenters 6.0 and try to connect using vSphere Client we get this issue "Invalid URL: The hostname could not parsed." When we get this error we need to do some changes in the vCenter advanced settings to fix the issue.
This article outlines why you need to choose a backup solution that protects your entire environment – including your VMware ESXi and Microsoft Hyper-V virtualization hosts – not just your virtual machines.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question