RE: [NTSysADM] Time change on a member server

[David McSpadden]

Looks like just a hardware fault and a bios clock with the wrong time.
Still suspect of it but can find nothing.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Micheal Espinola Jr
Sent: Wednesday, November 16, 2016 11:29 AM
To: ntsysadm@lists.myitforum.com
Subject: Re: [NTSysADM] Time change on a member server

Without a timezone change? I'd be suspect of malware. I've seen similar, but 
its been a few years.

On Wed, Nov 16, 2016 at 7:18 AM David McSpadden 
<dav...@imcu.com<mailto:dav...@imcu.com>> wrote:
Looked like 5 hours almost exactly.


From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com>] 
On Behalf Of Micheal Espinola Jr
Sent: Wednesday, November 16, 2016 9:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Time change on a member server

I've never seen/heard that happen outside of other influences.  How "off" was 
the time?

--
Espi


On Wed, Nov 16, 2016 at 6:13 AM, David McSpadden 
<dav...@imcu.com<mailto:dav...@imcu.com>> wrote:
I have a server 2012 member server of a 2012 Domain that magically changed it’s 
time last night and had to be powered of and on this morning to correct the 
issue.
Has anyone seen a server that shows the time source as the PDC in the domain 
but still magically changes it’s own time?

We have 24 other member servers in this domain that did not exhibit this same 
function last night?

Any direction would be greatly appreciated.


David McSpadden
System Administrator
Indiana Members Credit Union
P: 317.554.8190
[Description: Description: imcu email icon]<http://imcu.com/>  [Description: 
Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU>   
[Description: Description: twitter email icon] 
<https://twitter.com/IndMembersCU>

[Description: Description: email logo]
[http://www.amuletsolutions.com/images/mcp.gif]<http://www.google.com/url?sa=i=j==s=images==rja=8=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw=http://www.amuletsolutions.com/awards.aspx=bv.110151844,d.amc=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg=1450459757284499>


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.
--
-- Espi (via mobile)
This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.

Please consider the environment before printing this email.

Re: [NTSysADM] Time change on a member server

[Micheal Espinola Jr]

Without a timezone change? I'd be suspect of malware. I've seen similar,
but its been a few years.

On Wed, Nov 16, 2016 at 7:18 AM David McSpadden <dav...@imcu.com> wrote:

> Looked like 5 hours almost exactly.
>
>
>
>
>
> *From:* listsad...@lists.myitforum.com [mailto:
> listsad...@lists.myitforum.com] *On Behalf Of *Micheal Espinola Jr
> *Sent:* Wednesday, November 16, 2016 9:46 AM
> *To:* ntsysadm@lists.myitforum.com
> *Subject:* Re: [NTSysADM] Time change on a member server
>
>
>
> I've never seen/heard that happen outside of other influences.  How "off"
> was the time?
>
>
> --
> Espi
>
>
>
>
>
> On Wed, Nov 16, 2016 at 6:13 AM, David McSpadden <dav...@imcu.com> wrote:
>
> I have a server 2012 member server of a 2012 Domain that magically changed
> it’s time last night and had to be powered of and on this morning to
> correct the issue.
>
> Has anyone seen a server that shows the time source as the PDC in the
> domain but still magically changes it’s own time?
>
>
>
> We have 24 other member servers in this domain that did not exhibit this
> same function last night?
>
>
>
> Any direction would be greatly appreciated.
>
>
>
>
>
> *David McSpadden*
>
> System Administrator
>
> Indiana Members Credit Union
>
> P: 317.554.8190
>
> [image: Description: Description: imcu email icon] <http://imcu.com/>  [image:
> Description: Description: facebook email icon]
> <https://www.facebook.com/IndianaMembersCU>  [image: Description:
> Description: twitter email icon] <https://twitter.com/IndMembersCU>
>
>
>
> [image: Description: Description: email logo]
>
> [image: http://www.amuletsolutions.com/images/mcp.gif]
> <http://www.google.com/url?sa=i=j==s=images==rja=8=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw=http://www.amuletsolutions.com/awards.aspx=bv.110151844,d.amc=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg=1450459757284499>
>
>
>
> This e-mail and any files transmitted with it are property of Indiana
> Members Credit Union, are confidential, and are intended solely for the use
> of the individual or entity to whom this e-mail is addressed. If you are
> not one of the named recipient(s) or otherwise have reason to believe that
> you have received this message in error, please notify the sender and
> delete this message immediately from your computer. Any other use,
> retention, dissemination, forwarding, printing, or copying of this email is
> strictly prohibited.
>
>
>
> Please consider the environment before printing this email.
>
>
>
> This e-mail and any files transmitted with it are property of Indiana
> Members Credit Union, are confidential, and are intended solely for the use
> of the individual or entity to whom this e-mail is addressed. If you are
> not one of the named recipient(s) or otherwise have reason to believe that
> you have received this message in error, please notify the sender and
> delete this message immediately from your computer. Any other use,
> retention, dissemination, forwarding, printing, or copying of this email is
> strictly prohibited.
>
> Please consider the environment before printing this email.
>
-- 
-- Espi (via mobile)

RE: [NTSysADM] Time change on a member server

[David McSpadden]

Thank you but it looks good right now.
Only one clock as well,  no multiple clocks are set up.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Coombs, Darryl
Sent: Wednesday, November 16, 2016 10:24 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Time change on a member server

Silly question, but did you check the time zone setting on it?  Maybe somebody 
accidentally changed it.

DC

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of David McSpadden
Sent: Wednesday, November 16, 2016 11:42 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Time change on a member server

Looked like 5 hours almost exactly.


From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Micheal Espinola Jr
Sent: Wednesday, November 16, 2016 9:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Time change on a member server

I've never seen/heard that happen outside of other influences.  How "off" was 
the time?

--
Espi


On Wed, Nov 16, 2016 at 6:13 AM, David McSpadden 
<dav...@imcu.com<mailto:dav...@imcu.com>> wrote:
I have a server 2012 member server of a 2012 Domain that magically changed it’s 
time last night and had to be powered of and on this morning to correct the 
issue.
Has anyone seen a server that shows the time source as the PDC in the domain 
but still magically changes it’s own time?

We have 24 other member servers in this domain that did not exhibit this same 
function last night?

Any direction would be greatly appreciated.


David McSpadden
System Administrator
Indiana Members Credit Union
P: 317.554.8190
[Description: Description: imcu email icon]<http://imcu.com/>  [Description: 
Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU>   
[Description: Description: twitter email icon] 
<https://twitter.com/IndMembersCU>

[Description: Description: email logo]
[http://www.amuletsolutions.com/images/mcp.gif]<http://www.google.com/url?sa=i=j==s=images==rja=8=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw=http://www.amuletsolutions.com/awards.aspx=bv.110151844,d.amc=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg=1450459757284499>


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.
This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.

Please consider the environment before printing this email.

RE: [NTSysADM] Time change on a member server

[David McSpadden]

We are ET.
After the reboot it is within ms of the PDC.
MS patches current as of last Tuesday’s 11/8 patches.


From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Michael B. Smith
Sent: Wednesday, November 16, 2016 10:25 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Time change on a member server

ET part of Indiana or CT?

ET would indicate that it lost timezone info. Does it have current patches? How 
“close” is it to the PDC timewise?

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of David McSpadden
Sent: Wednesday, November 16, 2016 10:12 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: RE: [NTSysADM] Time change on a member server

Looked like 5 hours almost exactly.


From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Micheal Espinola Jr
Sent: Wednesday, November 16, 2016 9:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Time change on a member server

I've never seen/heard that happen outside of other influences.  How "off" was 
the time?

--
Espi


On Wed, Nov 16, 2016 at 6:13 AM, David McSpadden 
<dav...@imcu.com<mailto:dav...@imcu.com>> wrote:
I have a server 2012 member server of a 2012 Domain that magically changed it’s 
time last night and had to be powered of and on this morning to correct the 
issue.
Has anyone seen a server that shows the time source as the PDC in the domain 
but still magically changes it’s own time?

We have 24 other member servers in this domain that did not exhibit this same 
function last night?

Any direction would be greatly appreciated.


David McSpadden
System Administrator
Indiana Members Credit Union
P: 317.554.8190
[Description: Description: imcu email icon]<http://imcu.com/>  [Description: 
Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU>   
[Description: Description: twitter email icon] 
<https://twitter.com/IndMembersCU>

[Description: Description: email logo]
[http://www.amuletsolutions.com/images/mcp.gif]<http://www.google.com/url?sa=i=j==s=images==rja=8=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw=http://www.amuletsolutions.com/awards.aspx=bv.110151844,d.amc=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg=1450459757284499>


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.
This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.

Please consider the environment before printing this email.

RE: [NTSysADM] Time change on a member server

[Coombs, Darryl]

Silly question, but did you check the time zone setting on it?  Maybe somebody 
accidentally changed it.

DC

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of David McSpadden
Sent: Wednesday, November 16, 2016 11:42 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Time change on a member server

Looked like 5 hours almost exactly.


From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Micheal Espinola Jr
Sent: Wednesday, November 16, 2016 9:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Time change on a member server

I've never seen/heard that happen outside of other influences.  How "off" was 
the time?

--
Espi


On Wed, Nov 16, 2016 at 6:13 AM, David McSpadden 
<dav...@imcu.com<mailto:dav...@imcu.com>> wrote:
I have a server 2012 member server of a 2012 Domain that magically changed it’s 
time last night and had to be powered of and on this morning to correct the 
issue.
Has anyone seen a server that shows the time source as the PDC in the domain 
but still magically changes it’s own time?

We have 24 other member servers in this domain that did not exhibit this same 
function last night?

Any direction would be greatly appreciated.


David McSpadden
System Administrator
Indiana Members Credit Union
P: 317.554.8190
[Description: Description: imcu email icon]<http://imcu.com/>  [Description: 
Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU>   
[Description: Description: twitter email icon] 
<https://twitter.com/IndMembersCU>

[Description: Description: email logo]
[http://www.amuletsolutions.com/images/mcp.gif]<http://www.google.com/url?sa=i=j==s=images==rja=8=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw=http://www.amuletsolutions.com/awards.aspx=bv.110151844,d.amc=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg=1450459757284499>


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.

RE: [NTSysADM] Time change on a member server

[Michael B. Smith]

ET part of Indiana or CT?

ET would indicate that it lost timezone info. Does it have current patches? How 
“close” is it to the PDC timewise?

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of David McSpadden
Sent: Wednesday, November 16, 2016 10:12 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Time change on a member server

Looked like 5 hours almost exactly.


From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com] On Behalf Of Micheal Espinola Jr
Sent: Wednesday, November 16, 2016 9:46 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: Re: [NTSysADM] Time change on a member server

I've never seen/heard that happen outside of other influences.  How "off" was 
the time?

--
Espi


On Wed, Nov 16, 2016 at 6:13 AM, David McSpadden 
<dav...@imcu.com<mailto:dav...@imcu.com>> wrote:
I have a server 2012 member server of a 2012 Domain that magically changed it’s 
time last night and had to be powered of and on this morning to correct the 
issue.
Has anyone seen a server that shows the time source as the PDC in the domain 
but still magically changes it’s own time?

We have 24 other member servers in this domain that did not exhibit this same 
function last night?

Any direction would be greatly appreciated.


David McSpadden
System Administrator
Indiana Members Credit Union
P: 317.554.8190
[Description: Description: imcu email icon]<http://imcu.com/>  [Description: 
Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU>   
[Description: Description: twitter email icon] 
<https://twitter.com/IndMembersCU>

[Description: Description: email logo]
[http://www.amuletsolutions.com/images/mcp.gif]<http://www.google.com/url?sa=i=j==s=images==rja=8=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw=http://www.amuletsolutions.com/awards.aspx=bv.110151844,d.amc=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg=1450459757284499>


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.

RE: [NTSysADM] Time change on a member server

[David McSpadden]

It is physical at a remote location.
The w32tm responses all look accurate and comparable to the other remote 
physical servers.

From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Charles F Sullivan
Sent: Wednesday, November 16, 2016 9:56 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] Time change on a member server

Is this server a VM? If so it could be syncing with a host whose clock is off.

Also, when you run “w32tm /query /peers” it should show a DC as the peer. And 
if you run “w32tm /query /status” it should tell you what it synced from, 
whether it was successful and what time it last did the sync.

Instead of rebooting, you can run those commands to check. If things look 
right, you could try “w32tm /resync /rediscover”. If “/peers” doesn’t list a 
DC, then you can try “w32tm /config /syncfromflags:domhier”, then “w32tm 
/config /update”.

From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> 
[mailto:listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com>] 
On Behalf Of David McSpadden
Sent: Wednesday, November 16, 2016 9:13 AM
To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com>
Subject: [NTSysADM] Time change on a member server

I have a server 2012 member server of a 2012 Domain that magically changed it’s 
time last night and had to be powered of and on this morning to correct the 
issue.
Has anyone seen a server that shows the time source as the PDC in the domain 
but still magically changes it’s own time?

We have 24 other member servers in this domain that did not exhibit this same 
function last night?

Any direction would be greatly appreciated.


David McSpadden
System Administrator
Indiana Members Credit Union
P: 317.554.8190
[Description: Description: imcu email icon]<http://imcu.com/>  [Description: 
Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU>   
[Description: Description: twitter email icon] 
<https://twitter.com/IndMembersCU>

[Description: Description: email logo]
[http://www.amuletsolutions.com/images/mcp.gif]<http://www.google.com/url?sa=i=j==s=images==rja=8=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw=http://www.amuletsolutions.com/awards.aspx=bv.110151844,d.amc=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg=1450459757284499>


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.
This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.

Please consider the environment before printing this email.

RE: [NTSysADM] Time change on a member server

[David McSpadden]

Looked like 5 hours almost exactly.


From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On 
Behalf Of Micheal Espinola Jr
Sent: Wednesday, November 16, 2016 9:46 AM
To: ntsysadm@lists.myitforum.com
Subject: Re: [NTSysADM] Time change on a member server

I've never seen/heard that happen outside of other influences.  How "off" was 
the time?

--
Espi


On Wed, Nov 16, 2016 at 6:13 AM, David McSpadden 
<dav...@imcu.com<mailto:dav...@imcu.com>> wrote:
I have a server 2012 member server of a 2012 Domain that magically changed it’s 
time last night and had to be powered of and on this morning to correct the 
issue.
Has anyone seen a server that shows the time source as the PDC in the domain 
but still magically changes it’s own time?

We have 24 other member servers in this domain that did not exhibit this same 
function last night?

Any direction would be greatly appreciated.


David McSpadden
System Administrator
Indiana Members Credit Union
P: 317.554.8190
[Description: Description: imcu email icon]<http://imcu.com/>  [Description: 
Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU>   
[Description: Description: twitter email icon] 
<https://twitter.com/IndMembersCU>

[Description: Description: email logo]
[http://www.amuletsolutions.com/images/mcp.gif]<http://www.google.com/url?sa=i=j==s=images==rja=8=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw=http://www.amuletsolutions.com/awards.aspx=bv.110151844,d.amc=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg=1450459757284499>


This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.


Please consider the environment before printing this email.

This e-mail and any files transmitted with it are property of Indiana Members 
Credit Union, are confidential, and are intended solely for the use of the 
individual or entity to whom this e-mail is addressed. If you are not one of 
the named recipient(s) or otherwise have reason to believe that you have 
received this message in error, please notify the sender and delete this 
message immediately from your computer. Any other use, retention, 
dissemination, forwarding, printing, or copying of this email is strictly 
prohibited.

Please consider the environment before printing this email.

RE: [NTSysADM] Time change on a member server

[Charles F Sullivan]

Is this server a VM? If so it could be syncing with a host whose clock is
off.



Also, when you run “w32tm /query /peers” it should show a DC as the peer.
And if you run “w32tm /query /status” it should tell you what it synced
from, whether it was successful and what time it last did the sync.



Instead of rebooting, you can run those commands to check. If things look
right, you could try “w32tm /resync /rediscover”. If “/peers” doesn’t list
a DC, then you can try “w32tm /config /syncfromflags:domhier”, then “w32tm
/config /update”.



*From:* listsad...@lists.myitforum.com [mailto:
listsad...@lists.myitforum.com] *On Behalf Of *David McSpadden
*Sent:* Wednesday, November 16, 2016 9:13 AM
*To:* ntsysadm@lists.myitforum.com
*Subject:* [NTSysADM] Time change on a member server



I have a server 2012 member server of a 2012 Domain that magically changed
it’s time last night and had to be powered of and on this morning to
correct the issue.

Has anyone seen a server that shows the time source as the PDC in the
domain but still magically changes it’s own time?



We have 24 other member servers in this domain that did not exhibit this
same function last night?



Any direction would be greatly appreciated.





*David McSpadden*

System Administrator

Indiana Members Credit Union

P: 317.554.8190

[image: Description: Description: imcu email icon]   [image:
Description: Description: facebook email icon]
  [image: Description:
Description: twitter email icon] 



[image: Description: Description: email logo]

[image: http://www.amuletsolutions.com/images/mcp.gif]




This e-mail and any files transmitted with it are property of Indiana
Members Credit Union, are confidential, and are intended solely for the use
of the individual or entity to whom this e-mail is addressed. If you are
not one of the named recipient(s) or otherwise have reason to believe that
you have received this message in error, please notify the sender and
delete this message immediately from your computer. Any other use,
retention, dissemination, forwarding, printing, or copying of this email is
strictly prohibited.



Please consider the environment before printing this email.

Re: [NTSysADM] Time change on a member server

[Micheal Espinola Jr]

I've never seen/heard that happen outside of other influences.  How "off"
was the time?

--
Espi


On Wed, Nov 16, 2016 at 6:13 AM, David McSpadden  wrote:

> I have a server 2012 member server of a 2012 Domain that magically changed
> it’s time last night and had to be powered of and on this morning to
> correct the issue.
>
> Has anyone seen a server that shows the time source as the PDC in the
> domain but still magically changes it’s own time?
>
>
>
> We have 24 other member servers in this domain that did not exhibit this
> same function last night?
>
>
>
> Any direction would be greatly appreciated.
>
>
>
>
>
> *David McSpadden*
>
> System Administrator
>
> Indiana Members Credit Union
>
> P: 317.554.8190
>
> [image: Description: Description: imcu email icon]   [image:
> Description: Description: facebook email icon]
>   [image: Description:
> Description: twitter email icon] 
>
>
>
> [image: Description: Description: email logo]
>
> [image: http://www.amuletsolutions.com/images/mcp.gif]
> 
>
>
>
> This e-mail and any files transmitted with it are property of Indiana
> Members Credit Union, are confidential, and are intended solely for the use
> of the individual or entity to whom this e-mail is addressed. If you are
> not one of the named recipient(s) or otherwise have reason to believe that
> you have received this message in error, please notify the sender and
> delete this message immediately from your computer. Any other use,
> retention, dissemination, forwarding, printing, or copying of this email is
> strictly prohibited.
>
> Please consider the environment before printing this email.
>