KYiin-ComputerMD
asked on
Time and date on domain-joined laptop abruptly change to a seemingly random future time and date
Hello fellow Experts Exchange members:
I have a curious issue with one domain-joined laptop. (This problem does NOT occur on any other laptop or desktop, domain-joined or workgroup.)
Sporadically throughout each day, the time and date on the laptop will change to seemingly random times and dates in the future.
For example: the time and date changed to around 3 AM January 31, 2018 abruptly today (January 23, 2018).
The user corrected the time and date, and a short while later the time and date changed to around 5 PM January 28, 2018.
The user corrected the time and date again, and a short while later the time and date changed to around 5 AM January 28, 2018.
I am reviewing several event logs from the laptop and the PDC emulator, and I would appreciate any assistance from others who have encountered any similar issue before.
Sincerely,
Kahn
I have a curious issue with one domain-joined laptop. (This problem does NOT occur on any other laptop or desktop, domain-joined or workgroup.)
Sporadically throughout each day, the time and date on the laptop will change to seemingly random times and dates in the future.
For example: the time and date changed to around 3 AM January 31, 2018 abruptly today (January 23, 2018).
The user corrected the time and date, and a short while later the time and date changed to around 5 PM January 28, 2018.
The user corrected the time and date again, and a short while later the time and date changed to around 5 AM January 28, 2018.
I am reviewing several event logs from the laptop and the PDC emulator, and I would appreciate any assistance from others who have encountered any similar issue before.
Sincerely,
Kahn
ASKER
Hello Alan:
Thank you for assisting!
Unfortunately, the laptop is often used outside of the office (with no connection to any DC) and in different time zones in the US and Europe.
Currently, the Parameters on the W32Time service are set as follows:
(Default) (value not set)
NtpServer time.nist.gov,0x9
Type AllSync
As there are no problems with any other domain machines, I have to hold on changing any GPO settings. However, I would like to review the appropriate settings in the GPM console.
Would you have any suggestions of which settings I need to look for when reviewing the policies?
Thank you for assisting!
Unfortunately, the laptop is often used outside of the office (with no connection to any DC) and in different time zones in the US and Europe.
Currently, the Parameters on the W32Time service are set as follows:
(Default) (value not set)
NtpServer time.nist.gov,0x9
Type AllSync
As there are no problems with any other domain machines, I have to hold on changing any GPO settings. However, I would like to review the appropriate settings in the GPM console.
Would you have any suggestions of which settings I need to look for when reviewing the policies?
ASKER
Also, I am not sure if this is relevant, but the computer seems to be "hesitating" momentarily for five-to-ten seconds at a time quite often. I have attached an image showing Performance Monitor monitoring the CPU.
2.png
2.png
ASKER
Reviewing the System event log on the laptop:
1/23/2018, 1:15:47 PM, EID 1, The system returned from a low power state
Sleep time: 2018-01-23T18:06:14.656806
Wake time: 2018-01-23T18:15:44.912003
1/23/2018 1:15:51 PM, EID 37, The time provider NtpClient is currently receiving valid time data from DC1
1/23/2018 1:15:53 PM, EID 37, The time provider NtpClient is currently receiving valid time data from DC1
There is one more entry at the correct time:
1/23/2018, 1:15:58 PM, EID 7036, The Windows Modules Installer entered the running state.
Abruptly, the *very next* entry reads:
1/31/2018, 2:56:53 AM, EID 1, The system time has changed to 2018-01-31T07:56:53.2
And entries afterward are at the same time and date:
1/31/2018, 2:56:53 AM, EID 1, The system time has changed to 2018-01-31T07:56:53.2
Then the Time-Service logs a few entries:
Error -
1/31/2018, 2:58:13 AM, EID 34, The time service has detected that the system time needs to be changed by -653771 seconds. The time service will not change the system time by more than 172800 seconds. Verify that your time and time zone are correct, and that the time source DC1 is working properly.
Warning -
1/31/2018, 2:58:58 AM, EID 134, NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The requested name is valid, but no data of the requested type was found. (0x80072AFC)
Information -
1/31/2018, 2:58:59 AM, EID 37, The time provider NtpClient is currently receiving valid time data from DC1.
A question at this point: how can the time provider be receiving valid time data from DC1 when the two machines should be out-of-sync by more than 8 days?
1/23/2018, 1:15:47 PM, EID 1, The system returned from a low power state
Sleep time: 2018-01-23T18:06:14.656806
Wake time: 2018-01-23T18:15:44.912003
1/23/2018 1:15:51 PM, EID 37, The time provider NtpClient is currently receiving valid time data from DC1
1/23/2018 1:15:53 PM, EID 37, The time provider NtpClient is currently receiving valid time data from DC1
There is one more entry at the correct time:
1/23/2018, 1:15:58 PM, EID 7036, The Windows Modules Installer entered the running state.
Abruptly, the *very next* entry reads:
1/31/2018, 2:56:53 AM, EID 1, The system time has changed to 2018-01-31T07:56:53.2
And entries afterward are at the same time and date:
1/31/2018, 2:56:53 AM, EID 1, The system time has changed to 2018-01-31T07:56:53.2
Then the Time-Service logs a few entries:
Error -
1/31/2018, 2:58:13 AM, EID 34, The time service has detected that the system time needs to be changed by -653771 seconds. The time service will not change the system time by more than 172800 seconds. Verify that your time and time zone are correct, and that the time source DC1 is working properly.
Warning -
1/31/2018, 2:58:58 AM, EID 134, NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The requested name is valid, but no data of the requested type was found. (0x80072AFC)
Information -
1/31/2018, 2:58:59 AM, EID 37, The time provider NtpClient is currently receiving valid time data from DC1.
A question at this point: how can the time provider be receiving valid time data from DC1 when the two machines should be out-of-sync by more than 8 days?
ASKER
A few more entries:
1/31/2018, 3:01:25 AM, EID 42, The system is entering sleep
Sleep reason: System Idle
1/31/2018, 3:01:25 AM, EID 131, NtpClient was unable to set a domain peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The requested name is valid, but no data of the requested type was found. (0x80072AFC).
1/31/2018, 3:06:58 AM, EID 1, The system time has changed to 2018-01-31T08:06:58.5
1/31/2018, 3:07:08 AM, EID 37, The time provider NtpClient is currently receiving valid time data from DC1
1/31/2018, 3:07:17 AM, EID 34, The time service has detected that the system time needs to be changed by -653771 seconds. The time service will not change the system time by more than 172800 seconds. Verify that your time and time zone are correct, and that the time source DC1 is working properly.
1/31/2018, 3:11:55 AM, EID 42, The system is entering sleep.
Sleep reason: System Idle
1/31/2018, 3:11:55 AM, EID 134, NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The requested name is valid, but no data of the requested type was found. (0x80072AFC)
1/31/2018, 3:11:55 AM, EID 131, NtpClient was unable to set a domain peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The requested name is valid, but no data of the requested type was found. (0x80072AFC).
1/31/2018, 3:21:57 AM, EID 1, The system time has changed to 2018-01-31T08:21:57.5
1/31/2018, 3:21:59 AM, EID 1, The system has returned from a low power state.
Sleep Time: 2018-01-31T08:11:53.8
Wake Time: 2018-01-31T08:21:58.3
Entries are logged for the wrong time until the user manually corrects the time.
The last entries before the time correction are:
1/31/2018, 3:36:32 AM, EID 37, The time provider NtpClient is currently receiving valid time data from DC2.
1/31/2018, 3:36:46 AM, EID 34, The time service has detected that the system time needs to be changed by -653771 seconds. The time service will not change the system time by more than 172800 seconds. Verify that your time and time zone are correct, and that the time source DC2 is working properly.
1/31/2018, 3:36:48 AM, EID 36888, A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal alert code is 10.
Target name: %3
The TLS alert registry can be found at http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-6
1/31/2018, 3:36:48 AM, EID 36888, A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal alert code is 10.
Target name: %3
The TLS alert registry can be found at http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-6
1/31/2018, 3:38:04 AM, EID 7036, The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state.
After the manual time correction:
1/23/2018, 2:04:05 PM, EID 1, The system time has changed to 2018-01-23T19:04:05.0
1/23/2018, 2:04:05 PM, EID 1, The system time has changed to 2018-01-23T19:04:05.0
1/23/2018, 2:05:55 PM, EID 1, The system time has changed to 2018-01-23T19:05:55.5
1/23/2018, 2:05:55 PM, EID 35, The time service is now synchronizing the system time with the time source DC2.
1/31/2018, 3:01:25 AM, EID 42, The system is entering sleep
Sleep reason: System Idle
1/31/2018, 3:01:25 AM, EID 131, NtpClient was unable to set a domain peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The requested name is valid, but no data of the requested type was found. (0x80072AFC).
1/31/2018, 3:06:58 AM, EID 1, The system time has changed to 2018-01-31T08:06:58.5
1/31/2018, 3:07:08 AM, EID 37, The time provider NtpClient is currently receiving valid time data from DC1
1/31/2018, 3:07:17 AM, EID 34, The time service has detected that the system time needs to be changed by -653771 seconds. The time service will not change the system time by more than 172800 seconds. Verify that your time and time zone are correct, and that the time source DC1 is working properly.
1/31/2018, 3:11:55 AM, EID 42, The system is entering sleep.
Sleep reason: System Idle
1/31/2018, 3:11:55 AM, EID 134, NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The requested name is valid, but no data of the requested type was found. (0x80072AFC)
1/31/2018, 3:11:55 AM, EID 131, NtpClient was unable to set a domain peer to use as a time source because of DNS resolution error on ''. NtpClient will try again in 3473457 minutes and double the reattempt interval thereafter. The error was: The requested name is valid, but no data of the requested type was found. (0x80072AFC).
1/31/2018, 3:21:57 AM, EID 1, The system time has changed to 2018-01-31T08:21:57.5
1/31/2018, 3:21:59 AM, EID 1, The system has returned from a low power state.
Sleep Time: 2018-01-31T08:11:53.8
Wake Time: 2018-01-31T08:21:58.3
Entries are logged for the wrong time until the user manually corrects the time.
The last entries before the time correction are:
1/31/2018, 3:36:32 AM, EID 37, The time provider NtpClient is currently receiving valid time data from DC2.
1/31/2018, 3:36:46 AM, EID 34, The time service has detected that the system time needs to be changed by -653771 seconds. The time service will not change the system time by more than 172800 seconds. Verify that your time and time zone are correct, and that the time source DC2 is working properly.
1/31/2018, 3:36:48 AM, EID 36888, A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal alert code is 10.
Target name: %3
The TLS alert registry can be found at http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-6
1/31/2018, 3:36:48 AM, EID 36888, A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal alert code is 10.
Target name: %3
The TLS alert registry can be found at http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-6
1/31/2018, 3:38:04 AM, EID 7036, The WinHTTP Web Proxy Auto-Discovery Service service entered the stopped state.
After the manual time correction:
1/23/2018, 2:04:05 PM, EID 1, The system time has changed to 2018-01-23T19:04:05.0
1/23/2018, 2:04:05 PM, EID 1, The system time has changed to 2018-01-23T19:04:05.0
1/23/2018, 2:05:55 PM, EID 1, The system time has changed to 2018-01-23T19:05:55.5
1/23/2018, 2:05:55 PM, EID 35, The time service is now synchronizing the system time with the time source DC2.
ASKER
Ten minutes later, the time abruptly jumps forward and backward:
1/23/2018, 2:19:43 PM, EID 7036, The Application Experience service entered the stopped state.
1/23/2018, 3:14:54 PM, EID 1, The system time has changed to 2018-01-23T20:14:54.2
1/23/2018, 3:14:54 PM, EID 1, The system time has changed to 2018-01-23T20:14:54.2
1/23/2018, 2:26:37 PM, EID 1, The system time has changed to 2018-01-23T19:26:37.8
1/23/2018, 2:34:54 PM, EID 52, The time service has set the time with offset 14636935015497773 seconds.
Everything is normal until 3 PM ... then abruptly:
1/23/2018, 3:01:06 PM, EID 7036, The Google Update Service (gupdate) service entered the stopped state.
1/28/2018, 4:48:09 PM, EID 1, The system time has changed to 2018-01-28T21:48:09.4
1/28/2018, 4:48:09 PM, EID 36, The time service has not synchronized the system time for the last 86400 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients after %2 seconds. The time service will continue to retry and sync time with its time sources. Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization. You can control the frequency of the time source rediscovery using ClockHoldoverPeriod W32time config setting. Modify the EventLogFlags W32time config setting if you wish to disable this message.
1/28/2018, 4:48:09 PM, EID 34, The time service has detected that the system time needs to be changed by -437531 seconds. The time service will not change the system time by more than 172800 seconds. Verify that your time and time zone are correct, and that the time source DC2 is working properly.
The user manually corrected the time again (the last entry before the time change was at 1/28/2018, 5:30:55 PM) to 1/23/2018, 4:00:37 PM.
Then at 4:05:22 PM, the time changed again to 1/28/2018, 4:29:12 AM.
The user manually corrected the time again (the last entry before the time change was at 1/28/2018, 5:15:53 AM) to 1/23/2018, 4:57:45 PM.
1/23/2018, 2:19:43 PM, EID 7036, The Application Experience service entered the stopped state.
1/23/2018, 3:14:54 PM, EID 1, The system time has changed to 2018-01-23T20:14:54.2
1/23/2018, 3:14:54 PM, EID 1, The system time has changed to 2018-01-23T20:14:54.2
1/23/2018, 2:26:37 PM, EID 1, The system time has changed to 2018-01-23T19:26:37.8
1/23/2018, 2:34:54 PM, EID 52, The time service has set the time with offset 14636935015497773 seconds.
Everything is normal until 3 PM ... then abruptly:
1/23/2018, 3:01:06 PM, EID 7036, The Google Update Service (gupdate) service entered the stopped state.
1/28/2018, 4:48:09 PM, EID 1, The system time has changed to 2018-01-28T21:48:09.4
1/28/2018, 4:48:09 PM, EID 36, The time service has not synchronized the system time for the last 86400 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients after %2 seconds. The time service will continue to retry and sync time with its time sources. Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization. You can control the frequency of the time source rediscovery using ClockHoldoverPeriod W32time config setting. Modify the EventLogFlags W32time config setting if you wish to disable this message.
1/28/2018, 4:48:09 PM, EID 34, The time service has detected that the system time needs to be changed by -437531 seconds. The time service will not change the system time by more than 172800 seconds. Verify that your time and time zone are correct, and that the time source DC2 is working properly.
The user manually corrected the time again (the last entry before the time change was at 1/28/2018, 5:30:55 PM) to 1/23/2018, 4:00:37 PM.
Then at 4:05:22 PM, the time changed again to 1/28/2018, 4:29:12 AM.
The user manually corrected the time again (the last entry before the time change was at 1/28/2018, 5:15:53 AM) to 1/23/2018, 4:57:45 PM.
ASKER
Also, reviewing the DC1 and DC2 System event logs, neither log shows any discrepancies in time, time changes, or even any entries made by the Time-Service.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Group Policy settings are generally the best option.
Is the laptop setup to receive the date / time from the DC or some other source? If not, then I suggest setting it to get them from the DC.
Is this a setting that is applied from Group Policy (generally it will be, but might have been changed)? If not, then I suggest setting it via a GPO (and the same for all domain machines).
Thanks,
Alan.