Windows Server 2016 datetime switching between two values repeatedly
I have a Windows 2016 Standard server, whose time seems to oscillate between two values every second or two. It would suggest to me that two different things are repeatedly trying to reset the time.
I've run:
w32tm /resync
net time \\DC /set
which sets it to today's date (in the tray), which is currently 17/12/2021 11:35, but after a couple of seconds it then switches to 14/12/2021 22:09, and then a couple of seconds later changes back again. It's a SQL server so this is causing some interesting issues, although it's a dev box, not live.
How can I tell what else is setting the datetime, or, failing that what other pieces of software/services might be doing so?
If I run w32tm /query /source, I get:
Free-running system clock
And if I run w32tm /query /configuration, I get:
EventLogFlags: 2 (Local)
AnnounceFlags: 10 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 6 (Local)
MaxPollInterval: 10 (Local)
MaxNegPhaseCorrection: 4294967295 (Local)
MaxPosPhaseCorrection: 4294967295 (Local)
MaxAllowedPhaseOffset: 300 (Local)
FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 1 (Local)
UpdateInterval: 100 (Local)
[TimeProviders]
NtpClient (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
CrossSiteSyncFlags: 2 (Local)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Local)
ResolvePeerBackoffMaxTimes: 7 (Local)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 1 (Local)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (Local)
Type: AllSync (Local)
NtpServer: time.windows.com,0x8 (Local)
VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
NtpServer (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 0 (Local)
InputProvider: 0 (Local)
Following @harrymc 's comments below, looking at the eventvwr for event ID 4616 (the system time was changed), there are two processes modifying the system time. I've looked them up in the task managed, tab Services:
PID: 0x394 => 916 (correct time)
Group: LocalServiceNetworkRestricted
vmictimesync
TimeBrokerSvc
Imhosts
EventLog
Dhcp
PID: 0x3a8 => 936 (incorrect time)
Group: Local Service
WinHttpAutoProxySvc
W32Time *-> Windows Time Service?*
nsi
netprofm
FontCache
EventSystem
CDPSvc
Stopping the Windows Time service leaves the time at the correct value, so this is a fix, although why it's trying to set it to a time that is 3 days old, I'm rather confused by. I'll leave the service switched off for the moment.
There is possibly another fix through Akina's comments below by removing time.windows.com as a time server. If I find a fix this way, I'll augment this post. Thanks to both @harrymc and @akina.
To find which process changed the date/time, consult Event ID 4616 : The system time was changed:
- Run the Event Viewer
- Position to Windows Logs > Security
- Right-click Security and select "Filter Current Log..."
- In the dialog Filter Current Log, Filter tab, enter the
Event ID 4616 - Click OK
In the displayed events list, click on an event to see its details, and especially under "Process Information" see the "Name" field.