Domain Controller time is incorrect

I have a domain controller running in VM on Hyper-V, the time seems to be steadily getting faster, over the X-mas period it's 5 faster, which seems odd!

I know how to change the time and I belive we setup an NTP server on the DC and ensured time-sync was turned off on Hyper-V.

I don't really want to keep setting the time. Is there a reason why the time is fast?

Solution 1:

I know how to change the time and I belive we setup an NTP server on the DC and ensured time-sync was turned off on Hyper-V.

Virtual Machines can't track time. You may want to try setting up the DC up as an NTP client. This blog might be useful.

http://www.aperture.ro/index.php/2009/01/windows-time-sync-hyper-v-enabled-domain-controller-dilemma/

The guy waffles for a bit, but scroll down and you will get the necessary registry entries. This KB article seems a bit more authorative.

http://support.microsoft.com/kb/223184

There is also a Technet article on configuring a DC to use NTP:

http://technet.microsoft.com/en-us/library/cc784553(WS.10).aspx

As for why this happens, VMware has a writeup about timekeeping with VMs (not HyperV, but the concepts still apply).

http://www.vmware.com/pdf/vmware_timekeeping.pdf

Solution 2:

With VM's you always want the host to sync the guests, it's the only reliable way.

I realise this can create an infinite loop if the hosts are member servers of the domain, but every workaround I've tried (VMware server in my case) doesn't actually solve the problem.

If you run a good monitoring system (eg, Nagios) consider checking clock skew against the global NTP pool, or a reliable *nix based system (that's not a VM itself) running the NTPD package.

Solution 3:

VMs never keep accurate time (meaning they always have bad virtual CPU stats too), the only way to make sure they're accurate enough is to have them sync with a physical clock. This can be done either by syncing with the host and having all the hosts time correct via NTP or via having the VMs get their time via NTP with frequent checks - either method works but the former is probably the easiest.