System Time Change

Question

Sometimes we encounter a time change event on our servers (w2k16) that was initiated by Local Service account.

Oftentimes it was just a second or two of adjustment on the system time.

However, there are times it (may) seem to show a big gap in the time difference. Like the example below.

• Previous Time: 2023‎-‎06‎-‎04T11:06:49.047296200Z
• New Time: ‎2023‎-‎06‎-‎04T19:06:48.427633400Z

When we check the log, we can't find how the Previous Time (shown above) came to be.

All other log entries shows in the range of 19:06:xx and not 11:06:xx.

We think that the previous time is represented in a different time zone and the new time is our current time zone.

In this case Previous Time is in GMT while New Time is GMT +8.

Is this normal? Any article related to this?

Answer 1

Should have also been

Log Name:      System
Source:        Microsoft-Windows-Time-Service
Event ID:      142
Task Category: None
Level:         Warning
User:          LOCAL SERVICE
Description:
The time service has stopped advertising as a time source because the local clock is not synchronized.

either case I'd try resetting the time service.

w32tm /unregister
net stop w32time
w32tm /register
net start w32time
w32tm /config /syncfromflags:domhier /update***
net stop w32time
net start w32time

then check

w32tm /query /source
w32tm /query /configuration

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

What does the server use for a time source? What logs are you looking at? No, not normal.

Answer 3

Ok well the Windows Time Service always works with GMT times. The time zone and or DST are just offsets on top of GMT that windows applications can use. You might check the

System event log Time-Service events and also check Applications and Services Log\Microsoft\Windows\Time-Service\Operational events for more clues. If a single instance of windows then you could also reset the time service.

w32tm /unregister
net stop w32time
w32tm /register
net start w32time
w32tm /config /syncfromflags:domhier /update***
net stop w32time
net start w32time

then check

w32tm /query /source
w32tm /query /configuration

Some general info

• All domain members should use NT5DS domain time.
• Desktops and member servers sync with any domain controller.
• Domain controllers sync with PDC emulator (one per domain)
• PDC emulator in child domain can sync with any domain controller in parent domain.
• PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.

https://blogs.technet.microsoft.com/nepapfe/2013/03/01/its-simple-time-configuration-in-active-directory/

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

This is what we are trying to check.

1 - log entry shows the time change of a fraction of a second.

• Previous Time: ‎ 2023‎-‎06‎-‎04T19:03:48.597039600Z
• New Time: ‎ 2023‎-‎06‎-‎04T**19:03:48.**596000000Z

2 - log entry shows the time change made a big jump from 11:06:49 to 19:06:48.

• Previous Time: 2023‎-‎06‎-‎04T11:06:49.047296200Z
• New Time: ‎ 2023‎-‎06‎-‎04T**19:06:48.**427633400Z

No log entry in between showing that the time change back from 19:xx:xx to 11:xx:xx.

Answer 5

This the System event log entry that coincides with the time change.

No events on Applications and Services Log\Microsoft\Windows*Time-Service*