Best Practices for Configuring Time in a Virtualized Environment

I frequently work with customers who are having trouble with time synchronization in their virtualized environment (whether they know it or not). Accurate time is immensely important in a Windows domain since the primary authentication protocol is Kerberos. Kerberos uses time-based ticketing and if the time is off 5 minutes or more between computers, random authentication errors and other problems occur.

Time synchronization normally occurs automatically in a Windows domain, but things can get pretty screwed up in a virtualized environment when the VMs are configured to sync from a host with inaccurate time.

The following are my best practices for configuring and managing time in a virtualized environment:

• Configure the Domain Controller holding the PDC Emulator FSMO role to synchronize time from an accurate time source. Run the following two commands from an elevated CMD prompt:

w32tm /config /manualpeerlist:pool.ntp.org /syncfromflags:manual /reliable:yes /update

net stop w32time && net start w32time

• Use pool.ntp.org as your external time source, as shown above. This is a load balanced set of time servers located around the world and will return the best server for your geographic location. You may instead want to get time from an internal source, In this case, change the w32tm command as required. You can specify multiple peers by enclosing them in quotes separated by spaces (i.e., /manualpeerlist:"source1 source2"). Your PDC Emulator needs User Datagram Protocol (UDP) port 123 access to get time from the target, so configure your firewall accordingly.

• Disable time synchronization for all domain-joined VMs. How you do this depends on your virtualization platform. In VMware ESX it depends on the version you're running. In Hyper-V you do this by disabling Time Synchronization in Hyper-V Integration Services of the VM, as shown below.

Note that while I have always advised doing this, Microsoft has recently updated their guidance to match (at least for domain controllers). See TechNet article, Running Domain Controllers in Hyper-V. I recommend doing this for all VMs.

• Ensure your VM host is configured to get accurate time. If you run VMware vSphere or ESX you must configure the host to get time from an external time source. VMware has a nasty habit of syncing time to VMs even though you've told it not to. See my article, Fixing Time Errors on VMware vSphere and ESX Hosts. If you're running Hyper-V you should also configure the host to get accurate time. If the host is a member of the domain it should sync with the domain hierarchy, so you're set. If the host is in a workgroup, configure it to get Internet Time from pool.ntp.org, as shown below. Note that domain-joined computers do not have the Internet Time tab.

• Restart the Windows Time service on all domain computers to synchronize time with the domain hierarchy. The Windows Time service is responsible for syncing time in the network. The computer's time should automatically update to match the Domain Controller time a few seconds after restarting the service. Use the following command to reset the service:

net stop w32time && net start w32time

If the time difference is more than a 5 minutes, you may find that the computer will not update its time. You may need to reset the time manually, then restart the Windows Time service to get it into sync.

Please refer to the excellent TechNet article, How the Windows Time Service Works for more detailed about how time synchronization works in a computer network.