Link to home
Start Free TrialLog in
Avatar of itadminnek
itadminnekFlag for Afghanistan

asked on

Windows XP Time Syncs Backwards

Hey Experts,

I have a Windows XP Pro machine that is joined to a domain and it keeps changing its time back an hour or two. If I change it to the correct time...within a couple of hours, it will change the time back again. But it isn't the same time every time...sometimes its 1 hour and other times 2 hours.

 I checked the XP's time settings and everything is correct...time, date, time zone. I also checked the domain controller's, Windows Server 2008 R2, time, date, time zone and that is correct too. I have tried removing and rejoining the domain...any ideas? Is there a command to check to see what it is syncing to?

Let me know if you have any questions!

Thanks!
SOLUTION
Avatar of Member_2_6492660_1
Member_2_6492660_1
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of itadminnek

ASKER

The register location was set to time.windows.com...so I changed it to my domain controllers IP and restart the Windows Time service.

We will see what happens...

Anything else I can check out in the meantime?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Robert Retzer
Make sure the time zone is setup correctly for your system and day light savings time is active.
Well I just checked it this morning and the current actual time is 8:57 AM and the XP machine is showing 1:59 AM. The registry location I modified still shows the domain controller IP address I changed it to. I am going to run a virus scan just to be safe but I do not think that is the problem.

trgrassijr55 - I did restart to w32time service after making the change to the registry. That's another thing that is weird...I did take a look at the Event Viewer but it shows dates of the year 2028 on something and I can't find anything even close to this month. Is there a specific spot you can guide me to in the Event Viewer?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Hi trgrassijr55,

I put a different battery in the motherboard and also verified the system bios clock on start up and everything was correct...it is still go back an hour every so often. I didn't anything in the event viewer for event id 7036.

Any other ideas to check?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Hi trgrassijr55,

Well I disabled all startups and all non-Microsoft services and restarted the computer and after a couple hours it has gone back 2 - 3 hours...

Any other ideas?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
By looking at all the work you have done, this is really stumping me. What happens if you leave the network cable unplugged over night?  Does the time roll back then?  If it only seems to roll back when it is connect to the network I would lean towards been a malware issue, I will try process explorer to see if there is something unusual running in the background. If after running malware scans and using process explorer does not resolve the issue, I would probably lean toward re-imaging the computer after backing it up.
trgrassijr55 - I did a net time and it comes back saying the current time on my domain controller which is the correct time and location for it to be pulling from.

web_tracker - I disabled the network on the computer and it still go back an hour every hour it seems...I don't think it is malware though because you can see earlier in this discussion...I ran a virus scan and found nothing

But at least we know it is the computer itself doing the time changes because the connection to the network was disabled,

Any other ideas?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I agree web tracker...that is what I am working on right now...
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I am wondering if it was some type of malware on your system that your scanning failed to detect. It was very strange. I am glad at least you got it working properly. I really had to scratch my head on that one.
It was what fixed that issue