Windows Server 2008 Event ID 1 Kernel-General .... time sync?

Question

Recently noticed that every once in a while only our 2008 servers log this event ID and adjust the time usually 3 or 4 seconds. What is this and why have I never noticed before? They are all set to sync off of one of our domain controllers. I've run w32tm and net time and everything looks good so I am at a loss as to why this is happening. Any help is greatly appreciated.

Thanks,

Solution

I don't know why you have never noticed it before, but Kernel-General event ID 1 occurs whenever Windows changes the system time, regardless of whether it's a virtual machine or not. Windows changes the system time whenever it detects that the authoritative time, whether that be an NTP server or a Hyper-V host with Time Sync Integration Service, differs from the system clock on that server.

If your clock changes by 3 or 4 seconds on a regular basis, that means your clock is not very good and so it needs correcting often. This is definitely a common problem with virtual machines, but can happen on physical machines too with poor or failing CMOS clocks.

The Hyper-V time sync service takes priority over traditional NTP Windows Time Service settings. Even if the command w32tm /query /peers shows that you're set to sync from a domain controller, look in your logs for Time-Service events and you will see that the guest OS ends up syncing with the VM IC Time Sync Provider, even after receiving valid NTP data from the network. I've also experienced problems with Windows perfmon counters when a guest is configured to sync time with a VMware host.

I actually prefer traditional NTP service when I have a reliable hardware NTP time service to sync with (or even ntp.org if business policies allow syncing with internet sources.) So if I had to choose one over the other, I would disable the integration service rather than disabling Windows Time service on the guest OS.

Comments

[Philip]

Note: Disabling time sync is usually a bad idea; though there are several exceptions to that generalization. If this is a VM, his w32tm service should be disabled, not the VM time sync.