2

I currently run a Win2k3 Domain controller inside a VMware Server for a small setup, the Vmware runs on a Win2k8 system.

The problem i have is that the time on the Domain Controller is extremely unstable, is there any way to redirect the authoritative time source from the domain controller to the Host (which is also in the Domain).

The reason I have the Domain controller not directly running on the Win2k8 box on physical hardware is that it made some problems to install Vmware on the Domain controller box (and I need it because of some stuff which runs on a virtual Linux).

Or is there a way to get VMware (or any other virtualization solution) running peacefully on the same install (I hade some problem with the virtual network adapters)?

It is by no way a big domain, more for testing purposes - but wrong time is really annoying.

Thanks

Fionn
  • 475
  • 5
  • 15
  • Have you got a proper time source configured for the domain controller? Vmwaretools synctime is not very reliable, so try going native. – wzzrd Jul 03 '09 at 09:45

3 Answers3

3

You may take a look at this paper (VmWare TimeKeeping), also you may setup an ntp server on the host machine and make the guest sync with it.

Here's an article about configuring the Windows Time Service.

The instability of your time is maybe caused by the guest DC who's time is updated both from the PDC emulator and via the vmware tools, if you want only the vmware tools to sync the time there's an NoSync registry key for w32time.

Hope this helps.

Maxwell
  • 5,076
  • 1
  • 26
  • 31
  • +1 - It may not be "preferred" to run a DC inside VMware, but I have a Customer who has been doing it with great success. Their PDC Emulator FSMO role-holder in their forest-root domain is running on a VMware ESX instance, sync'ing its hardware clock to the ESX host's hardware clock via VMware tools (with the W32time service disabled in the guest OS), and the host is doing an NTP sync to public NTP server pool. All other computers in the AD forest sync to that server, either directly or through another stratum of machines (the other DCs). – Evan Anderson Jul 03 '09 at 10:51
1

I run both my PDC & SDC on VMWare and have never had a problem. I set the guest OSes using NTP.

This is the command I use to setup time on NTP on my PDC (by default all other DCs look to the PDC to sync time with and all member servers and workstations look to their logon server.

w32tm /config /manualpeerlist:"0.us.pool.ntp.org,0x08 1.us.pool.ntp.org,0x08 2.us.pool.ntp.org,0x08 3.us.pool.ntp.org,0x08" /syncfromflags:manual /reliable:yes /update & net stop w32time & net start w32time & w32tm /resync

JamesBarnett
  • 1,129
  • 8
  • 12
0

It is usually recommended that you do not run a domain controller in a VM for this reason.

It should be noted that the VMWare time sync is not perfect (it can usually only correct time in one direction) and should not be used at the same time as any another time synchronisation technique so should be turned off for you DC VM.

You should ensure that something not running in a VM (say, the host) has an accurate clock by running ensuring that either the Windows time service or an alternative like NTP is running and correctly configured. Then you should ensure that the OS in the VM is similarly configured to keep its clock in sync with that clock.

I usually recommend proper NTP (the Windows compile of it I use can be found here though there are others available) inside VMs as this does not step the clock with large changes like many other time sync techniques. Make sure you specify the option 

tinker panic 0

at the top of the config file in VMs though, otherwise it will give in and stop working if a sudden spike of load on the VM or host causes the clock to temporarily drift beyond a certain point.

David Spillett
  • 22,754
  • 45
  • 67
  • Is there any way to run a PDC on a machine with a Vmware server on it (for the virtual linux) without having the network adapter problem? Because this is the only reason that the PDC is running inside the VMware. Or is there a possiblity for the PDC to redirect the primary time source to an NTP address? – Fionn Jul 03 '09 at 10:41
  • @Fionn: What is "the network adapter problem"? Are you talking about the server computer registering its VMware virtual adapters in DNS? If so, have a look at my answer here: http://serverfault.com/questions/33425/domain-controller-adds-unwanted-dns-entries/33427#33427 – Evan Anderson Jul 03 '09 at 10:48