I have an Active Directory Domain with Win2008R2 DCs and Win7 clients.
From about 2 months ago some of my clients are complaining one after another about time of their systems which is behind the DC time.
When I nailed the problem I noticed permissions of
"C:\Windows\System32\LogFiles\wmi\RtBackup" folder is the key to the problem. Group 'System' should have access to this folder and
based on some unknown reasons this permission is deleted.
Because of this permission problem, 'Windows Event Log' service is stopped either. And as you know when the clients' time is not synchronized with DC, they don't accept new policies too.
When I correct the permission and reboot the clients, every thing works fine.
Do you know what is causing this problem? What is changing permissions of RtBackup folder? Or how can I prevent other clients to have this problem?