windows 2016 steps into future for half hour at 23:00 CET and then returns to normal

Question

I have asp.net core 3.1 program with a very basic async socket receiver and a blazor webassembly frontend. Every half an hour a machine sends a report (+/- 1000 bytes) to it, which is then stored to sqlserver and to a file on disk.
Al thru the day this works fine except for at around 23:00 CET then the report is received as normal but the file time is around 23:30 so half an hour into the future! Also the recorded in the database is equally half an hour into the future.

The file is written with File.WriteAllText(xfilepath, xcontent); In the frontend i can see the report beeing added to the database also half an hour into the future.

This whole program runs as a hosted server on windows 2016 virtual machine region Netherlands timezone UTC+1 Amsterdam, Berlin...

Also posted with code on stackoverflow: datetime-now-on-windows-2016-skips-30-minutes-into-future

Anybody any idea what is going on here??

Answer 1

Hi Dirk,
Thanks for the screenshots and the Kernel-General event ID 1 indeed proved that the time has been changed on the machine.

Did you know which source is used for the machine to sync time? Kindly check by following command. We used to encounter scenarios when two time sources used and issue occurred for another one.

w32tm /query [/computer:<target>] {/source | /configuration
https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings

Moreover, kindly search event ID 4616, which supposed to record info when system time changes and specify which process triggerred such change.
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4616
Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
Hope above info would be bit helpful.

If above steps still fail to capture the process or service to change time, it is suggested to use process monitor tool and verify changes around the issue occurrence.
https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

Last suggestion is to re-register the windows time service:

----------

Hope this helps and please help to accept as Answer if the response is useful.

Thanks,
Jenny