Domain controller - Time changing automatically problem

Question

Hi all,
here my environment:

3 sites/locations :

Default-First-Site-Name (Data center) :
2 domain controllers : dc1 (Windows Server 2016 Standard) holds 5 FSMO roles (PDC), dc2 (Windows Server 2012 R2 Standard) , Forest/Domain function level : Windows Server 2008 R2.

South site : 1 domain controller dc-south (Windows Server 2016 Standard)

North site : 1 domain controller dc-north (Windows Server 2012 R2 Standard)

All DCs are virtual machines (VMWare) , our timezone : GMT+7
Recently, my dc-south time is changed erratically (right -> wrong then wrong -> right)

There is another virtual machine placed same physical host with dc-south (not joined domain) and its time is fine, other DCs time are fine.
Our settings are as default , as MS documents , primary domain controller (PDC - my dc1) does not synchronize time with an external time source , it uses local clock, other DCs synchronize time from PDC , workstation clients/other servers (joined domain) synchronize time from nearest DC at their site.
dc1

w32tm /query /status  
Leap Indicator: 0(no warning)  
Stratum: 1 (primary reference - syncd by radio clock)  
Precision: -6 (15.625ms per tick)  
Root Delay: 0.0000000s  
Root Dispersion: 10.0000000s  
ReferenceId: 0x4C4F434C (source name:  "LOCL")  
Last Successful Sync Time: 5/12/2021 2:35:29 AM  
Source: Free-running System Clock  
Poll Interval: 6 (64s)  

dc2

w32tm /query /status  
Leap Indicator: 0(no warning)  
Stratum: 2 (secondary reference - syncd by (S)NTP)  
Precision: -6 (15.625ms per tick)  
Root Delay: 0.0312500s  
Root Dispersion: 10.2717954s  
ReferenceId: 0xC0A80068 (source IP:  192.168.0.104)  
Last Successful Sync Time: 5/11/2021 8:46:12 AM  
Source: dc1.mydomain.com  
Poll Interval: 10 (1024s)  

dc-south

w32tm /query /status  
Leap Indicator: 0(no warning)  
Stratum: 2 (secondary reference - syncd by (S)NTP)  
Precision: -6 (15.625ms per tick)  
Root Delay: 0.0040861s  
Root Dispersion: 10.4064500s  
ReferenceId: 0xC0A80068 (source IP:  192.168.0.104)  
Last Successful Sync Time: 5/12/2021 11:25:23 AM  
Source: dc1.mydomain.com  
Poll Interval: 10 (1024s)  

dc-north

w32tm /query /status  
Leap Indicator: 0(no warning)  
Stratum: 2 (secondary reference - syncd by (S)NTP)  
Precision: -6 (15.625ms per tick)  
Root Delay: 0.0312500s  
Root Dispersion: 10.2620506s  
ReferenceId: 0xC0A80068 (source IP:  192.168.0.104)  
Last Successful Sync Time: 5/11/2021 8:41:13 AM  
Source: dc1.mydomain.com  
Poll Interval: 10 (1024s)  
  

A workstation at south site

w32tm /query /status  
Leap Indicator: 0(no warning)  
Stratum: 3 (secondary reference - syncd by (S)NTP)  
Precision: -23 (119.209ns per tick)  
Root Delay: 0.0072910s  
Root Dispersion: 10.5137854s  
ReferenceId: 0xC0A80767 (source IP:  192.168.7.103)  
Last Successful Sync Time: 5/12/2021 11:32:29 AM  
Source: dc-south.mydomain.com  
Poll Interval: 12 (4096s)  

How can I find out what was causing the problem with dc-south time and fix it ? Please give me some advice, thank you very much.

Answer 1

Problem solved by Disabling Time Synchronization, thank you very much.

Answer 2

My PDC emulator is using local clock, it may be a few minutes wrong from real time but it is ok with me.
On my dc-south I did :

Disable time synchronization with the host via the registry:
Set the Enabled parameter to 0 in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider

• Enable W32Time debugging log and enabling the audit policy , restart Windows Time service , file C:\Windows\Temp\w32time.log was created . W32Time error appear 2 times last night , but I don't find any useful information from w32time.log (only 3KB, I don't know why) , here is it (I cover my dc name)

      153533 06:59:10.0791248s - ---------- Log File Opened -----------------
      153533 06:59:18.0026947s - Association: (Local) 0.0.0.0:123 => 192.168.0.104:123 (Remote)
      153533 06:59:18.0027615s - Created reachability group: (
      153533 06:59:18.0027861s - 192.168.0.104:123,
      153533 06:59:18.0028054s - )
      153533 06:59:18.0029071s - Reachability: Attempting to contact peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123).
      153533 06:59:18.0198296s - Reachability:  removing peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123).  LAST PEER IN GROUP!
      153533 06:59:19.9388040s - Association: (Local) 0.0.0.0:123 => 192.168.0.104:123 (Remote)
      153533 06:59:19.9388323s - Created reachability group: (
      153533 06:59:19.9388431s - 192.168.0.104:123,
      153533 06:59:19.9388522s - )
      153533 06:59:19.9388904s - Reachability: Attempting to contact peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123).
      153533 06:59:19.9441066s - Reachability:  peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123) is reachable.
  

Answer 3

Hi,

1, From the debug log you shared, the south-DC tried to synchronize time with PDC but failed to contact with it, so it removed DC1 from the time source.
Then, one minute later, it connected with PDC successfully.
It may explain why the time changed to the wrong time and to right time again.
To get more information in the debug log, let try to change the value from 116 to 0-116 for the following entry:
Value name: FileLogEntries
Data Type: String
Value:0-116
2, Enable the audit policy as mentioned above.

3, In the domain, it is suggested to use the NT5DS to sync time instead of NTP. (Except PDC)
Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type
Key Name: Type
Type: REG_SZ(String Value)
Data: NT5DS

Best Regards,

Answer 4

Hi,
There is new log
It happened from 2:33 AM (jump forward to 9:22 AM) --> 3:16 AM (jump back from 10:03 AM) today so this is log when it turned righ -> wrong (19:34 in log)

153534 19:30:01.9695922s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:40
153534 19:30:07.0009546s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:43
153534 19:30:12.0478985s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:44
153534 19:30:15.4343721s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153534 19:30:15.4344175s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
153534 19:30:15.4344832s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
153534 19:30:16.0792297s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
153534 19:30:21.1105591s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:35
153534 19:30:26.1263576s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:37
153534 19:30:31.1731892s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:40
153534 19:30:36.1889662s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
153534 19:30:41.2358955s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:44
153534 19:30:46.2829197s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:46
153534 19:30:50.3141678s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:34
153534 19:30:55.3455876s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:35
153534 19:31:00.3926024s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
153534 19:31:05.4237769s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:41
153534 19:31:10.4551845s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:43
153534 19:31:15.5020870s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:45
153534 19:31:19.5333725s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
153534 19:31:22.4339469s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153534 19:31:22.4339836s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
153534 19:31:22.4340445s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
153534 19:31:24.5334848s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:35
153534 19:31:29.5648183s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
153534 19:31:34.5961559s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
153534 19:31:39.6275402s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:42
153534 19:31:44.6588495s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
153534 19:31:49.7057769s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
153534 19:31:53.7527557s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
153534 19:31:58.8153712s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
153534 19:32:03.8622554s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
153534 19:32:08.9092804s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:40
153534 19:32:13.9405863s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
153534 19:32:18.9874972s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
153534 19:32:23.0188411s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
153534 19:32:28.0657806s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
153534 19:32:28.4335782s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153534 19:32:28.4336214s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
153534 19:32:28.4336830s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
153534 19:32:33.0971188s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
153534 19:32:38.1128218s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:40
153534 19:32:43.1441547s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
153534 19:32:48.1911368s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:44
153534 19:32:52.2224241s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
153534 19:32:54.6140845s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153534 19:32:54.6141277s - ListeningThread -- response heard from 192.168.27.104:123 <- 192.168.7.103:123
153534 19:32:54.6141529s - Computing server signature: OLD:FALSE, RID:00001582, format:0x1
153534 19:32:54.6147525s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.27.104:123
153534 19:32:57.2693821s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:34
153534 19:33:02.2851582s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
153534 19:33:07.3321823s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
153534 19:33:12.3478540s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:41
153534 19:33:17.3947175s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
153534 19:33:22.4416743s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:45
153534 19:33:26.4887286s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
153534 19:33:31.5199384s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:36
153534 19:33:32.4332459s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153534 19:33:32.4333159s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
153534 19:33:32.4334329s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
153534 19:33:36.5513208s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
153534 19:33:41.5982588s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
153534 19:33:46.6453317s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:42
153534 19:33:51.6765500s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
153534 19:33:56.7235209s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:45
153534 19:34:00.7391633s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
153534 19:34:05.7861493s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
153534 19:34:10.8174853s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
153534 19:34:15.8488443s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:41
153534 19:34:20.8801371s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
153534 19:34:25.8802490s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
153534 19:34:29.8962673s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
153535 02:22:11.9873236s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:71 KPhO:37
153535 02:22:12.6179811s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:22:12.6180237s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
153535 02:22:12.6181494s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
153535 02:22:17.1279778s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:37
153535 02:22:20.8929072s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:22:20.8929458s - ListeningThread -- response heard from 192.168.14.38:123 <- 192.168.7.103:123
153535 02:22:20.8929666s - Computing server signature: OLD:FALSE, RID:00001586, format:0x1
153535 02:22:20.8934826s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.14.38:123
153535 02:22:22.2533067s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:40
153535 02:22:27.3156594s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:41
153535 02:22:32.3781884s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
153535 02:22:35.4677652s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:22:35.4678218s - ListeningThread -- response heard from 192.168.14.38:123 <- 192.168.7.103:123
153535 02:22:35.4678529s - Computing server signature: OLD:FALSE, RID:00001586, format:0x1
153535 02:22:35.4685881s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.14.38:123
153535 02:22:37.5032427s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:44
153535 02:22:41.5600051s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:66 KPhO:34
153535 02:22:46.6284237s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
153535 02:22:51.6754080s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:39
153535 02:22:56.7536107s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:41
153535 02:23:01.8161771s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:43
153535 02:23:05.8318427s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:33
153535 02:23:10.8632873s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
153535 02:23:15.9101986s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
153535 02:23:19.6176036s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:23:19.6176667s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
153535 02:23:19.6177535s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
153535 02:23:20.9415032s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
153535 02:23:25.9728458s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:41
153535 02:23:31.0041704s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
153535 02:23:31.6591439s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:23:31.6591937s - ListeningThread -- response heard from 192.168.16.246:123 <- 192.168.7.103:123
153535 02:23:31.6592267s - Computing server signature: OLD:FALSE, RID:0000158E, format:0x1
153535 02:23:31.6603009s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.16.246:123
153535 02:23:36.0354748s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:44
153535 02:23:40.0512220s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:33
153535 02:23:45.0981556s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:34
153535 02:23:46.2487037s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:23:46.2487432s - ListeningThread -- response heard from 192.168.16.246:123 <- 192.168.7.103:123
153535 02:23:46.2487634s - Computing server signature: OLD:FALSE, RID:0000158E, format:0x1
153535 02:23:46.2493429s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.16.246:123
153535 02:23:47.7026771s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:23:47.7027486s - ListeningThread -- response heard from 192.168.16.246:123 <- 192.168.7.103:123
153535 02:23:47.7027878s - Computing server signature: OLD:FALSE, RID:0000158E, format:0x1
153535 02:23:47.7037445s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.16.246:123
153535 02:23:48.9860625s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:23:48.9861095s - ListeningThread -- response heard from 192.168.7.5:123 <- 192.168.7.103:123
153535 02:23:48.9861527s - Computing server signature: OLD:FALSE, RID:00001574, format:0x1
153535 02:23:48.9867558s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.5:123
153535 02:23:50.1294704s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:37
153535 02:23:55.1608324s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
153535 02:24:00.2077633s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:40
153535 02:24:03.5678160s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:24:03.5678611s - ListeningThread -- response heard from 192.168.7.5:123 <- 192.168.7.103:123
153535 02:24:03.5678813s - Computing server signature: OLD:FALSE, RID:00001574, format:0x1
153535 02:24:03.5684097s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.5:123
153535 02:24:05.0194377s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:24:05.0194881s - ListeningThread -- response heard from 192.168.7.5:123 <- 192.168.7.103:123
153535 02:24:05.0195080s - Computing server signature: OLD:FALSE, RID:00001574, format:0x1
153535 02:24:05.0200756s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.5:123
153535 02:24:05.2234541s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
153535 02:24:10.2548147s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
153535 02:24:12.3410671s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:24:12.3411408s - ListeningThread -- response heard from 192.168.7.5:123 <- 192.168.7.103:123
153535 02:24:12.3411803s - Computing server signature: OLD:FALSE, RID:00001574, format:0x1
153535 02:24:12.3421348s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.5:123
153535 02:24:14.2861103s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:34
153535 02:24:19.3330904s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:36
153535 02:24:24.3800565s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
153535 02:24:26.6159697s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 02:24:26.6160204s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
153535 02:24:26.6160916s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
153535 02:24:29.4270057s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:41
153535 02:24:34.4739545s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:44
153535 02:24:39.4896794s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
153535 02:24:43.5209700s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
153535 02:24:48.5835718s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
153535 02:24:53.5994412s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
153535 02:24:58.6462374s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:40
153535 02:25:03.6619475s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
153535 02:25:08.6932740s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:44

when it turned wrong -> right (03:04 in log)

153535 03:00:02.2719565s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:00:02.2720088s - ListeningThread -- response heard from 192.168.12.146:123 <- 192.168.7.103:123
153535 03:00:02.2720362s - Computing server digest: OLD:FALSE, RID:00000C98
153535 03:00:02.2726181s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.12.146:123
153535 03:00:05.2910943s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
153535 03:00:13.3380411s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:33
153535 03:00:22.4007088s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
153535 03:00:23.3096411s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:00:23.3097064s - ListeningThread -- response heard from 192.168.6.30:123 <- 192.168.7.103:123
153535 03:00:23.3097291s - Computing server signature: OLD:FALSE, RID:000015BD, format:0x1
153535 03:00:23.3104096s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.6.30:123
153535 03:00:27.6039932s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:00:27.6040342s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
153535 03:00:27.6040946s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
153535 03:00:30.4476735s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:33
153535 03:00:35.6467961s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:00:35.6468509s - ListeningThread -- response heard from 192.168.6.184:123 <- 192.168.7.103:123
153535 03:00:35.6468720s - Computing server signature: OLD:FALSE, RID:00002B0C, format:0x1
153535 03:00:35.6475718s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.6.184:123
153535 03:00:39.5416132s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
153535 03:00:43.8532369s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:00:43.8532758s - ListeningThread -- response heard from 192.168.6.224:123 <- 192.168.7.103:123
153535 03:00:43.8533026s - Computing server signature: OLD:FALSE, RID:00002AF4, format:0x1
153535 03:00:43.8538826s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.6.224:123
153535 03:00:47.6042305s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
153535 03:00:51.8100577s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:00:51.8101062s - ListeningThread -- response heard from 192.168.7.17:123 <- 192.168.7.103:123
153535 03:00:51.8101273s - Computing server digest: OLD:FALSE, RID:00000CF1
153535 03:00:51.8107565s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.17:123
153535 03:00:52.1668074s - PeerPollingThread: WaitTimeout
153535 03:00:52.1668740s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
153535 03:00:52.1671791s - Peer poll: Max:64.0000000s Cur:00.0000000s
153535 03:00:52.1672235s - PeerPollingThread: waiting 64.000s
153535 03:00:52.1878996s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:00:52.1879628s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
153535 03:00:52.1891085s - /-- NTP Packet:
153535 03:00:52.1891163s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
153535 03:00:52.1891275s - | Stratum: 1 - primary reference (syncd by radio clock)
153535 03:00:52.1891356s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
153535 03:00:52.1891518s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.0646s - 10.0245s
153535 03:00:52.1891704s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
153535 03:00:52.1891826s - | ReferenceTimestamp:   0xE447FE989F9B852C - 13265408280623466800ns - 153534 19:38:00.6234668s
153535 03:00:52.1892015s - | OriginateTimestamp:   0xE44866642AB98343 - 13265434852166893200ns - 153535 03:00:52.1668932s
153535 03:00:52.1892199s - | ReceiveTimestamp:     0xE44806DEFF9B5CE8 - 13265410398998464400ns - 153534 20:13:18.9984644s
153535 03:00:52.1892395s - | TransmitTimestamp:    0xE44806DEFFC4D22C - 13265410398999097000ns - 153534 20:13:18.9990970s
153535 03:00:52.1892606s - >-- Non-packet info:
153535 03:00:52.1892703s - | DestinationTimestamp: 153535 03:00:52.1892783s - 0xE4486664301DFB93153535 03:00:52.1892864s -  - 13265434852187957500ns153535 03:00:52.1892951s -  - 153535 03:00:52.1879575s
153535 03:00:52.1893060s - | RoundtripDelay: 20431700ns (0s)
153535 03:00:52.1893210s - | LocalClockOffset: -24453178644600ns - 407:33.178644600s
153535 03:00:52.1893412s - \--
153535 03:00:52.1893894s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
153535 03:00:52.1894180s - Peer poll: Max:64.0000000s Cur:63.9777353s
153535 03:00:52.1894410s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: -24453.1786446s
153535 03:00:52.1894681s - 5 Age:1 Ofs:-24453.1774126s COfs:-24453.1774157s Dly:+00.0205601s RDly:+00.0000000s Dsp:00.0007411s RDsp:10.0237732s Pnt:00.0029628s Dst:00.0205601s FDsp:00.0000115s Jitter:14.0825689s AgeTime:+64.0024913s
153535 03:00:52.1895184s - 4 Age:0 Ofs:-24453.1786446s COfs:-24453.1786446s Dly:+00.0204317s RDly:+00.0000000s Dsp:00.0000004s RDsp:10.0245056s Pnt:00.0000000s Dst:00.0204317s FDsp:00.0000115s Jitter:14.1003773s AgeTime:+00.0015047s
153535 03:00:52.1895660s - 3 Age:5 Ofs:-24453.1789675s COfs:-24453.1789683s Dly:+00.0203351s RDly:+00.0000000s Dsp:00.0044447s RDsp:10.0200653s Pnt:00.0177772s Dst:00.0203351s FDsp:00.0002892s Jitter:15.4392054s AgeTime:+384.0078404s
153535 03:00:52.1896133s - 2 Age:2 Ofs:-24453.1782662s COfs:-24453.1782659s Dly:+00.0197671s RDly:+00.0000000s Dsp:00.0014818s RDsp:10.0230255s Pnt:00.0059256s Dst:00.0197671s FDsp:00.0004744s Jitter:16.5715279s AgeTime:+128.0040584s
153535 03:00:52.1896606s - 1 Age:4 Ofs:-24453.1800619s COfs:-24453.1800658s Dly:+00.0197049s RDly:+00.0000000s Dsp:00.0037040s RDsp:10.0208130s Pnt:00.0148144s Dst:00.0197049s FDsp:00.0014004s Jitter:37.9869235s AgeTime:+320.0073035s
153535 03:00:52.1897119s - 0 Age:3 Ofs:-24453.1785989s COfs:-24453.1786024s Dly:+00.0186199s RDly:+00.0000000s Dsp:00.0029633s RDsp:10.0215454s Pnt:00.0118516s Dst:00.0186199s FDsp:00.0028820s Jitter:37.9869235s AgeTime:+256.0075042s
153535 03:00:52.1897626s - Peer jitter: 00.0008716s Filter Dispersion: 00.0028820s
153535 03:00:52.1898379s - W32TmServiceMain: resync req, irreg now pending.
153535 03:00:52.1898830s - W32TmServiceMain: waiting i0.000s (144.634s)
153535 03:00:52.1980672s - W32TmServiceMain: timeout
153535 03:00:52.1980892s - Sample Prepared at 132654348521980849 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
153535 03:00:52.1981079s - NtpClient returned 1 samples.
153535 03:00:52.1981169s - Sample 0 offset:-24453.1786024s delay:+00.0186199s dispersion:24463.2039014s
153535 03:00:52.1981322s - Intersection successful with 0 dropped samples.
153535 03:00:52.1981418s -   0: Sample:0 SyncDist:244792132113 SelectDisp:0
153535 03:00:52.1981502s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14480877
153535 03:00:52.1981773s - ClockDispln Update: SO:-244531786020 KPhO:4 *PhO:-244531786024 uT:8193
 SD:9223372036854775808 (i) LI:0 S:2 RDl:186199 RDs:244632139014 TSF:0x8 Spike
153535 03:00:52.1989318s - W32TmServiceMain: waiting 144.625s
153535 03:00:56.2137323s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
153535 03:01:01.0515837s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:01:01.0516260s - ListeningThread -- response heard from 192.168.6.33:123 <- 192.168.7.103:123
153535 03:01:01.0516475s - Computing server signature: OLD:FALSE, RID:0000142A, format:0x1
153535 03:01:01.0523028s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.6.33:123
153535 03:01:05.2763630s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
153535 03:01:08.8980856s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:01:08.8981690s - ListeningThread -- response heard from 192.168.16.247:123 <- 192.168.7.103:123
153535 03:01:08.8981951s - Computing server signature: OLD:FALSE, RID:00001431, format:0x1
153535 03:01:08.8988750s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.16.247:123
153535 03:01:13.3077391s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:35
153535 03:01:22.3547835s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
153535 03:01:29.0101165s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:01:29.0101619s - ListeningThread -- response heard from 192.168.7.130:123 <- 192.168.7.103:123
153535 03:01:29.0101828s - Computing server signature: OLD:FALSE, RID:00002ACC, format:0x1
153535 03:01:29.0108430s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.130:123
153535 03:01:30.3861960s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:35
153535 03:01:32.6035393s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:01:32.6036074s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
153535 03:01:32.6037321s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
153535 03:01:39.4488093s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:39
153535 03:01:47.5114478s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
153535 03:01:56.1678031s - PeerPollingThread: WaitTimeout
153535 03:01:56.1678482s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
153535 03:01:56.1679527s - Peer poll: Max:64.0000000s Cur:00.0000000s
153535 03:01:56.1679742s - PeerPollingThread: waiting 64.000s
153535 03:01:56.1759604s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:01:56.1760198s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
153535 03:01:56.1772990s - /-- NTP Packet:
153535 03:01:56.1773074s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
153535 03:01:56.1773186s - | Stratum: 1 - primary reference (syncd by radio clock)
153535 03:01:56.1773266s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
153535 03:01:56.1773434s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.0677s - 10.0253s
153535 03:01:56.1773621s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
153535 03:01:56.1773739s - | ReferenceTimestamp:   0xE447FE98A201B790 - 13265408280632838700ns - 153534 19:38:00.6328387s
153535 03:01:56.1773929s - | OriginateTimestamp:   0xE44866A42AF92E54 - 13265434916167864700ns - 153535 03:01:56.1678647s
153535 03:01:56.1774116s - | ReceiveTimestamp:     0xE448071EFE2A7CAB - 13265410462992835800ns - 153534 20:14:22.9928358s
153535 03:01:56.1774315s - | TransmitTimestamp:    0xE448071EFE52DD1C - 13265410462993451900ns - 153534 20:14:22.9934519s
153535 03:01:56.1774529s - >-- Non-packet info:
153535 03:01:56.1774626s - | DestinationTimestamp: 153535 03:01:56.1774710s - 0xE44866A42D0F4949153535 03:01:56.1774790s -  - 13265434916176014500ns153535 03:01:56.1774874s -  - 153535 03:01:56.1760145s
153535 03:01:56.1774986s - | RoundtripDelay: 7533700ns (0s)
153535 03:01:56.1775136s - | LocalClockOffset: -24453178795700ns - 407:33.178795700s
153535 03:01:56.1775341s - \--
153535 03:01:56.1775792s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
153535 03:01:56.1776006s - Peer poll: Max:64.0000000s Cur:63.9903328s
153535 03:01:56.1776227s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: -24453.1787957s
153535 03:01:56.1776495s - 5 Age:2 Ofs:-24453.1774126s COfs:-24453.1774125s Dly:+00.0205601s RDly:+00.0000000s Dsp:00.0014817s RDsp:10.0237732s Pnt:00.0059252s Dst:00.0205601s FDsp:00.0000231s Jitter:19.1324224s AgeTime:+127.9906730s
153535 03:01:56.1777002s - 4 Age:1 Ofs:-24453.1786446s COfs:-24453.1786414s Dly:+00.0204317s RDly:+00.0000000s Dsp:00.0007410s RDsp:10.0245056s Pnt:00.0029624s Dst:00.0204317s FDsp:00.0000462s Jitter:19.3705073s AgeTime:+63.9896864s
153535 03:01:56.1777546s - 3 Age:3 Ofs:-24453.1782662s COfs:-24453.1782627s Dly:+00.0197671s RDly:+00.0000000s Dsp:00.0022224s RDsp:10.0230255s Pnt:00.0088880s Dst:00.0197671s FDsp:00.0001851s Jitter:22.2113973s AgeTime:+191.9922401s
153535 03:01:56.1778062s - 2 Age:5 Ofs:-24453.1800619s COfs:-24453.1800626s Dly:+00.0197049s RDly:+00.0000000s Dsp:00.0044446s RDsp:10.0208130s Pnt:00.0177768s Dst:00.0197049s FDsp:00.0007406s Jitter:38.2617534s AgeTime:+383.9954852s
153535 03:01:56.1778551s - 1 Age:4 Ofs:-24453.1785989s COfs:-24453.1785992s Dly:+00.0186199s RDly:+00.0000000s Dsp:00.0037039s RDsp:10.0215454s Pnt:00.0148140s Dst:00.0186199s FDsp:00.0016665s Jitter:38.6478759s AgeTime:+319.9956859s
153535 03:01:56.1779030s - 0 Age:0 Ofs:-24453.1787957s COfs:-24453.1787957s Dly:+00.0075337s RDly:+00.0000000s Dsp:00.0000002s RDsp:10.0252533s Pnt:00.0000000s Dst:00.0075337s FDsp:00.0016666s Jitter:38.6478759s AgeTime:+00.0016294s
153535 03:01:56.1779508s - Peer jitter: 00.0008791s Filter Dispersion: 00.0016666s
153535 03:01:56.1780071s - W32TmServiceMain: resync req, irreg now pending.
153535 03:01:56.1780818s - W32TmServiceMain: waiting i0.000s (80.646s)
153535 03:01:56.1833989s - W32TmServiceMain: timeout
153535 03:01:56.1834181s - Sample Prepared at 132654349161834141 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
153535 03:01:56.1834346s - NtpClient returned 1 samples.
153535 03:01:56.1834433s - Sample 0 offset:-24453.1787957s delay:+00.0075337s dispersion:24463.2065947s
153535 03:01:56.1834576s - Intersection successful with 0 dropped samples.
153535 03:01:56.1834664s -   0: Sample:0 SyncDist:244792103615 SelectDisp:0
153535 03:01:56.1834744s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14484972
153535 03:01:56.1835015s - ClockDispln Update: SO:-244531787952 KPhO:37 *PhO:-244531787989 uT:4095
 SD:9223372036854775808 (i) LI:0 S:2 RDl:75337 RDs:244632165947 TSF:0x8 Spike
153535 03:01:56.1841558s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:41 KPhO:37
153535 03:01:56.1842131s - W32TmServiceMain: waiting 80.641s
153535 03:02:04.2304372s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
153535 03:02:13.3086975s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
153535 03:02:21.3556996s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
153535 03:02:27.5209714s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:02:27.5210152s - ListeningThread -- response heard from 192.168.27.154:123 <- 192.168.7.103:123
153535 03:02:27.5210367s - Computing server signature: OLD:FALSE, RID:0000144E, format:0x1
153535 03:02:27.5215993s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.27.154:123
153535 03:02:30.4183732s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:39
153535 03:02:37.6040909s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
153535 03:02:37.6041279s - ListeningThread -- response heard from 192.168.7

Answer 5

Hi,
First, make sure that all the virtual machines are not synchronizing time from host.

The virtual PDC emulator must always synchronize the time with an external source, and the time synchronization with the host must be disabled. This also applies to any other VMs joined to the domain.
To do this:
Disable time synchronization with the host via the registry:
Set the Enabled parameter to 0 in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider
Note, before change a registry, please backup the registry.

If you have already disabled the time sync from host, then we can try to figure out the cause by collecting the debug logs and enabling the audit policy.

1. Please enable W32Time debugging log on your server that is reporting this error.
    
   Collect the debug logs (the log analyze was not supported due to security reason)
   (1). Click the Start Menu, in Run, type regedit and press Enter.
   (2). Locate to the following key
    
   HKey_Local_Machine\System\CurrentControSet\Services\W32Time\Config
    
   (3). On the Edit menu, click New Value, and then add the following registry values:
    
   Value Name: FileLogSize
   Data Type: DWORD
   Value data: 0x10000000
    
   Value name: FileLogName
   Data Type: String
   Value data: C:\Windows\Temp\w32time.log
    
   Value name: FileLogEntries
   Data Type: String
   Value: 116
    
   (4). Restart Windows Time service.
   (5). After that please closely monitor the event log. After this W32Time error appear again, please go to the folder C:\Windows\Temp, find w32time.log and upload it to our workspace below.
   Run the following command to create the debug logs.
   net stop w32time
   net start w32time
   w32tm /resync /nowait

2, Enabling the audit policy on all the DCs or the problematic DC.

Update the policy, once the issue re-happens, the events will be logged.

Best Regards,