CWMS NTP issue

Similar Questions

• Machine virtual NTP Time Sync issue... What is the best practice today?

  Hello

  I'm confused, I get conflicting information on the synchronization time

  config to use these days for full P2V' ed infrastructure OK here a scenario:

  about 30 servers migrate and running on aa Infrastructure ESX vSphere 4, vCenter

  4... 2XW2K3 (virtualized) domain controllers the rest of them, a mix of

  DB and member servers of applications using several rolls. No. during the 'better '.

  Practice' wise I do...

  (A) keep the configuration of PDC emulator to retrieve it is time of a

  "A source of atomic time / NTP server, then keep windows time service running.

  and just the rest of the members field sync from there servers

  or I don't...

  (B) disable Windows time Service on all domain members and domain controllers

  Member breaks and have all the VMS recovery there time source NTP

  the host ESX via VMtools.

  Can someone give me a clear answer?  & lt;

  Concerning

  Peacey

  A

  Concerning

  Michael Haverbeck

  If you find this information useful, please give points to "correct" or "useful".

• PDC as a NTP server with no external link WAN

  A bit of a unique environment...

  Here's the background: R2 Windows Server 2012 (GUI) virtual (VMware, Hyper-V, don't think that it matters tho?)

  HIGHLY SECURE (No link whatsoever outside the network) environment which is currently in phase of tests .

  Small environment, then domain, DNS, and DHCP controller all-in-one...

  The issue is, this PDC must to also act as NTP server for the whole environment...

  Now, since there is no link with the outside world, I can not synchronize time with a server such as time.windows.com or pool.ntp.org time so I need to manually configure the time on DC1 and let members computers synchronize their time with mine, so we chronological consistent throughout the network, even if it can be turned off in regard to real-time.

  Sounds easy enough, but as my username suggests, I'm a total noob, then how?

  A few items of Microsoft (like this: https://support.microsoft.com/en-us/kb/816042) suggest that to set the internal clock as the source for our NTP server on the domain controller requires changes in the registry... I sincerely hope that as advanced as a 2012 R2 server should be able to something like that happen to without necessary to enter regedit.

  In addition, in the article above, will it work if my domain controller is a virtual machine, or it's only about physical machines?

  And once I have the task, the issue of the domain member computers comes to mind... the following thoughts come to mind:

  -Should I go into each computer only member and point manually to my DC to tell him that his also the NTP?

  -What about some news servers that join the domain?

  -Are there maybe a GPO, I can create this for me? And if so, how? (GPO Noob too = P)

  Thank you to troubleshoot a windows apprentice young power make it work and not get fired! =)

  Kind regards

  knowNoob

  This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)
  http://social.technet.Microsoft.com/forums/en-us/home s/fr-U.S./Accueil
  http://social.msdn.Microsoft.com/Forum
  
  
  If you give us a link to the new thread we can point to some resources it

• NTP server lag get higher

  Hello

  I installed the 2012 server in vmware esxi

  the server is a satandalone and is not a member of the domain

  I have configured the server to be a ntp client and synchronize time from an ntp server closest to you.

  When I check the offset of the time I get a 0.03 s

  and this result is good for my environment, but after some time the offset increase until it get 0.3 s

  What are the causes of the offset to change after a while and increase so high

  Thank you

  This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)
  *
  http://social.technet.Microsoft.com/forums/en-us/home s/fr-U.S./Accueil
  http://social.msdn.Microsoft.com/Forum

• CWMS 1.1 Site URL does not

  Hi all

  I have just deployly a new CWMS 1.1 for the customer, everything works well.

  However, after the CWMS 1.1 virtual machine power off and turn on again, all are very good except webex site URL is not available.

  I'm quite sure that the problem resides on CWMS 1.1 rather than the browser, as I use the same computer in both cases.

  Machin's virtual host / IP: webexadmin.webex.com 18.2.0.5

  Site URL / IP: webexweb.webex.com 18.2.0.7

  Admin URL / IP: webexsuper.webex.com 18.2.0.7

  I confirmed that DNS is working properly.   Admin URL works fine and I can use Admin credentials for access without problem.

  However, I'm not able to access the URL of the site, the page which lead me to the host of input user ID and password do not appears.

  By the way, I am also curious to know how CWMS 1.1 different requests for URL of the Site and the URL of the Admin because they were resolved to the same DNS server IP address?

  Help, please...

  Thank you

  Tian yan

  Hello Tian,

  Appolgise to a slow line here it was a long weekend in the United States.

  I would strongly sugguest you use this version 1.1.1.9 when you try to deploy expecially for mail server.

  CSCuc63386 Validation of email server in the initial setup sequence No.

  There was a bug in version 1.1.

  If you need help for new .ova feel free to open an SR and someone TAC will help you in this.

  Now, in regards to FQDN or IP feel free to open a SR we can do more tests, I don't expect this to and issue too long is valid and functional.

  Do not hesitate to reachout me privetly if you need help opening SR, I can do for you and take ownership.

  Kind regards

  Srdjan

• NTP configuration on the fire power module

  Anyone know how I can configure NTP on a module of firepower of Cisco for a series of ASA5500 FW?

  I did the initial installation, registered the module with my defense Center, but now I need to change the NTP settings. Can't seem to figure out where to do this, and if I go through the Setup again, I'm worried it's going to ruin my registration.

  The best way to configure NTP recommended is to make a portion of the system policy in the Management Center FireSIGHT (CMF).

  System > Local > political system. Pass under the time synchronization and there, in the section updated platform support the NTP to be "Via NTP Defense Center" (aka FMC). Earlier in this article, point your "Defense Center" on an NTP server or a set of servers authoritative. Save policy and exit and deploy it.

  Otherwise, you will need to re-run the module setup. He should pre-fill the issues of configuration with the current values of the system.

• NTP settings

  During the installation of version 4 NESTS sensors, the following questions are asked.

  Could you help her by giving the right answers for each of these issues if the sensor is located in Brussels, Belgium.

  Change the system clock settings? [No]: Yes

  Use NTP? [Yes]:

  Change the NTP server? [No]: Yes

  NTP server IP Address [x.x.x.x]:

  NTP key ID [1]:

  NTP key value [1]:

  Change the settings for daylight saving time? [No]: Yes

  Recurring, Date or turn it off? [Subscription]:

  Start month [April]:

  Beginning of the week [first]:

  In the morning [sun]:

  Start time [02:00:00]:

  End of month [oct]:

  [Last] week end:

  End of day [sun]:

  End time [02:00:00]:

  Area of DST [THIS]:

  Elbow [60]:

  Change the zone schedule system? [No]: Yes

  Zone [THIS]:

  Offset of UTC [60]:

  From what I can understand for Brussels (verified of http://www.timeanddate.com/worldclock/city.html?n=48), you need the following:

  Change the system clock settings? [No]: Yes

  Use NTP? [Yes]:

  Change the NTP server? [No]: Yes

  NTP server IP Address [x.x.x.x]:

  NTP Key ID [1]: 1 (can be anything if you NTP server requires authentication)

  NTP key value [1]: 1 (can be anything if you NTP server requires authentication)

  Change the settings for daylight saving time? [No]: Yes

  Recurring, Date or turn it off? [Subscription]: recurring

  Month [April]: March

  Start the week [first]: last

  Start the day [sun]: Sun

  Start time [02:00:00]: 02:00

  End of month [oct]: Oct

  [Last] weekend: last

  End of day [sun]: Sun

  End time [02:00:00]: 03:00

  DST zone [THIS]: (not sure on this field I think it's just a label for your time zone)

  Elbow [60]: 60 (given that your clock settings add one hour during daylight saving time)

  Change the zone schedule system? [No]: Yes

  Zone [THIS]: (not sure on this field I think it's just a label for your time zone)

  Offset of UTC [60]: 60 (since Brussels is UTC + 1)

• Routing issue of Cisco VPN Client ASA

  Hi, I use a Barracuda NG for firewalls and I would use a Cisco ASA 5505 for VPN Client connections. But I have the problem that I can't get a connection to the VPN PC connected to the internal network. But I can reach the VPN connected PC from the inside. Here is a diagram of my network:

  cisco_asa_prob.jpg

  

  Here the IP Configuration and the routing of the Barracuda firewall table:

  screen_shot_2014-08 - 12_at_16.01.42.png

  

  I have a route on the Barracuda NG to the 10.10.10.0/24 network VPN Client on eth0.

  The 192.168.1.0/24 LAN I ping the Client comes with Client VPN 10.10.10.11 as it should. But I can't ping or access network resources in the local network for AnyConnected customer's PC that connected through the VPN.

  Here is the config Cisco ASA:

   : Saved : : Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz : ASA Version 9.2(2) ! hostname leela names ip local pool VPN-Pool 10.10.10.10-10.10.10.200 mask 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 switchport access vlan 5 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.1.250 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address dhcp ! interface Vlan5 nameif dmz security-level 50 ip address 172.16.0.250 255.255.255.0 ! ftp mode passive clock timezone CEST 1 clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 dns domain-lookup inside dns server-group DefaultDNS name-server 192.168.1.10 same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network obj_any subnet 0.0.0.0 0.0.0.0 object network VPN-Pool subnet 10.10.10.0 255.255.255.0 description VPN-Pool object network NETWORK_OBJ_10.10.10.0_24 subnet 10.10.10.0 255.255.255.0 access-list inside_access_in extended permit ip any any access-list inside_access_in extended permit ip object VPN-Pool any access-list dmz_access_in extended permit ip any any access-list global_access extended permit ip any any access-list outside_access_in extended permit ip any any pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 mtu dmz 1500 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,dmz) source static any any destination static NETWORK_OBJ_10.10.10.0_24 NETWORK_OBJ_10.10.10.0_24 no-proxy-arp route-lookup inactive access-group inside_access_in in interface inside access-group outside_access_in in interface outside access-group dmz_access_in in interface dmz access-group global_access global route dmz 0.0.0.0 0.0.0.0 172.16.0.254 1 route inside 0.0.0.0 0.0.0.0 192.168.1.254 tunneled timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy server-type microsoft user-identity default-domain LOCAL aaa authentication enable console LDAP_SRV_GRP LOCAL aaa authentication http console LDAP_SRV_GRP LOCAL aaa authentication ssh console LDAP_SRV_GRP LOCAL aaa authentication serial console LOCAL http server enable 444 http 192.168.1.0 255.255.255.0 inside snmp-server location Vienna crypto ipsec ikev2 ipsec-proposal DES protocol esp encryption des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal 3DES protocol esp encryption 3des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES protocol esp encryption aes protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES192 protocol esp encryption aes-192 protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5 crypto ipsec security-association pmtu-aging infinite crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map inside_map interface inside crypto map dmz_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map dmz_map interface dmz crypto ca trustpoint ASDM_TrustPoint0 enrollment self subject-name CN=leela proxy-ldc-issuer crl configure crypto ca trustpoint ASDM_TrustPoint1 enrollment terminal crl configure crypto ca trustpool policy crypto ca certificate chain ASDM_TrustPoint0 quit crypto ikev2 policy 1 encryption aes-256 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 10 encryption aes-192 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 20 encryption aes integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 30 encryption 3des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 40 encryption des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 enable dmz client-services port 443 crypto ikev2 remote-access trustpoint ASDM_TrustPoint0 telnet timeout 5 no ssh stricthostkeycheck ssh 192.168.1.0 255.255.255.0 inside ssh timeout 30 ssh key-exchange group dh-group1-sha1 console timeout 0 dhcpd auto_config outside ! dhcpd address 192.168.1.254-192.168.1.254 inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept dynamic-filter updater-client enable dynamic-filter use-database ntp server 192.168.1.10 source inside ssl trust-point ASDM_TrustPoint0 dmz ssl trust-point ASDM_TrustPoint0 inside webvpn enable dmz no anyconnect-essentials anyconnect image disk0:/anyconnect-macosx-i386-3.1.05170-k9.pkg 1 anyconnect image disk0:/anyconnect-win-3.1.05170-k9.pkg 2 anyconnect image disk0:/anyconnect-linux-3.1.05170-k9.pkg 3 anyconnect image disk0:/anyconnect-linux-64-3.1.05170-k9.pkg 4 anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml anyconnect enable tunnel-group-list enable group-policy DfltGrpPolicy attributes default-domain value group-policy GroupPolicy_AnyConnect internal group-policy GroupPolicy_AnyConnect attributes wins-server none dns-server value 192.168.1.10 vpn-tunnel-protocol ikev2 ssl-client webvpn anyconnect profiles value AnyConnect_client_profile type user group-policy portal internal group-policy portal attributes vpn-tunnel-protocol ssl-clientless webvpn url-list none username tunnel-group AnyConnect type remote-access tunnel-group AnyConnect general-attributes address-pool VPN-Pool authentication-server-group LDAP_SRV_GRP default-group-policy GroupPolicy_AnyConnect tunnel-group AnyConnect webvpn-attributes group-alias AnyConnect enable tunnel-group Portal type remote-access tunnel-group Portal general-attributes authentication-server-group LDAP_SRV_GRP default-group-policy portal tunnel-group Portal webvpn-attributes group-alias portal enable! ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 ! prompt hostname context no call-home reporting anonymous hpm topN enable : end no asdm history enable

  Can someone please help me solve this problem?

  When I tried to solve this I didn't choose which interface the Packet Tracer?

  The interface inside or DMZ interface?  Inside, he says it will not work with the dmz but the error did not help me

  Anyone here knows why it does not work?

  screen_shot_2014-08 - 12_at_16.34.57.png

  

  screen_shot_2014-08 - 12_at_16.33.06.png

  

  Hello

  Inside LAN is directly connected to the right firewall VPN... then I don't think you have to have the itinerary tunnele... can you try to remove the road tunnel mode and check.

  entrance to the road that is static to achieve 10.10.10.11 as its display is correct...

  Route by tunnel watch also with 255 administrative distance.  I've never used that in my scenarios... lets see...

  Concerning

  Knockaert

• NTP server authentication

  I'll put up the master NTP server on Catalyst 4000 series switch. I want to implement authentication between the server and the client. I have the following commands is not working.

  What's wrong with the commands below?

  Server:

  NTP-1 xxx md5 authentication key

  authenticate the NTP

  NTP master 6

  NTP max-associations 10

  Client:

  NTP-1 xxx md5 authentication key

  authenticate the NTP

  key to NTP server 10.0.0.1 1

  AV

  I think there are two separate issues here and they are not really related to each other. It is a question if your switch must be configured as master ntp. If the switch is configured as master ntp, then it will offer his version of time that it is authoritative or not (either correct or not). I think it is a bad idea and hope that this is not something that you did intentionally.

  The other question is why the switch is not hours of instruction from the marine server. It seems that there are several reasons why this can happen. It is possible that the NTP requests you are not to get on the server or the server responses aren't you. My guess is that it probably is, since the show ntp association does not show a reference to the server of the Navy clock. Or it is possible that the NTP response is you but there's not enough variability in traffic through the network switch is not able to synchronize with the server. I saw a customer network when it's a problem for a while.

  I would say the next step could be to debug ntp package and see if you send to the correct address and see if you have found answers.

  HTH

  Rick

• Cisco ISE synchronization and NTP server

  I am currently implementing Cisco ISE to our customer.

  But having a little problem Cisco ISE cannot synchronize with NTP server.

  Keep in mind, NTP servers in AD.

  Currently, Cisco ISE synchronize just at the local level.

  Cisco ISE implemented distributed mode, when there are two Cisco ISE installed on VMware (Administration & monitoring primary & secondary node), and another is the device (political Service node).

  As a result of it might not sync server NTP and the ISE of Cisco, Cisco ISE often OUT-OF-SYN.

  Is there a solution for this problem?

  Gandhi,

  This is a known issue, I have crossed upwards and have not read that you use AD as your NTP server, there have been problems with integration of the ISE and ACS with AD as their ntp source, please use another device like sources ntp, for example a router.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Recommendation of NTP Orchestrator

  Another issue of NTP - for a large environment - is - better than Orchestrator use the local time of ESXi host or use the NTP server that is typically used by other components of the infrastructure?

  From my experience, you should point vRO NTP server on the same server as the vCenter/vRA... otherwise the plugin will not work correctly.

  Drugmand

• Matter of time and timezone VMware Appliance identity (NTP)

  I have deployed the latest version of VMware-identity-device - 2.0.1.2 - 1748175_OVF10 device. After connection GOES, I followed steps below.

  1. access https://< IP ID >: 5480

  2. set the IP address of the NTP server

  3. set the time zone in Asia/Calcutta

  For some time he shows good local time but after awhile, zone remains the same i.e. IST but its real time resets by - 5:30 which is UST. Looks like that NTP does not for this will

  This issue is not present in the device server vCAC. that is, it shows appropriate time to IST. Because of the time difference, we are facing questions during the vCAC SSO and IAAS server configuration.

  You have no work around for this problem?

  Thanks, but my problem is solved.

  It was because of my Active Directory server time. After registering Identity server with server advertising actually synchronize time with your ad server even if you have configured with the NTP server.

• How to configure NTP between Virtual Machines without using Vsphere Client

  I have a group of 8 virtual servers of 5.5 ESXi without an Internet connection. There are virtual machines on each of these 8 virtual servers.

  I did one of these 5.5 virtual ESXi host a NTP server by editing the file /etc/ntp.conf with below configuration and

  started the ntpd daemon. He began to take the time to its local clock, here's the output of ntpq Pei

  IP server 10.108.190.14

  ip address of the client 10.108.190.15

  Server /etc/ntp.conf

  > > driftfile/var/lib/ntp/drift

  > > server 127.127.1.0 maxpoll 4

  > > fondant 127.127.1.0 stratum 10

  | ntpq Pei

  |   refid distance st t when poll reach delay offset jitter

  | ==============================================================
  | * LOCAL (0). LIUX. 10 l 2 64 377 0.000 0.000 0.001

  Then I edited the file /etc/ntp.conf on customers with below configuration but the customer would not synchronize with the server. He

  wouldn t get response from the server. Here is the output of ntpq Pei

  Customer /etc/ntp.conf

  > > driftfile/var/lib/ntp/drift

  > > server 10.108.190.14 iburst

  | ntpq Pei

  |      refid distance st t when poll reach delay offset jitter

  | ==================================================================
  | 10.108.190.14 INIT. 16 u

  Now, when I configure NPT Client/Server on virtual machines through the Configuration Option under Option Configuration time

  in Vsphere Client everything works fine and the client and the server to synchronize with each other. I checked the file /etc/ntp.conf on both the client

  and the server and it has a couple of restrict 127.0.0.1 and restrict the lines added by default kod nomodify etc.

  So why NPT Server featured when enabled via Vsphere Client works very well, but it does not work when it is configured manually

  in the virtual servers directly.

  I was connected to a vCenter Server Appliance through the VSphere Client and enabled the synchronization of time of the NPT.

  I really need to know how to configure the NTP server without using the Vsphere Client so that I can automate the

  task by writing a python script that would connect to each virtual server and NTP Client/Server configuration.

  Any help in this issue deeply appreciated!

  Thank you!

  You can configure the ntp server without using viclient.

  Take a look @ http://kb.vmware.com/selfservice/documentLinkInt.do?micrositeID=&popup=true&languageId=&externalID=1003063

  Hope this helps

  -Assane

• features of the client ntp ESXi (interesting compliance requirement)

  Hi guys,.

  I was thrown an interesting compliance of a customer requirement. They demand that all averaged over servers ntp NTP updates (preferably 3) 2 (a particular layer, although I don't think this would have a bearing on the issue).

  Indeed, they want to question several NTP servers, the average of the difference between the updates provided by all servers then drift in that direction. Apparently, this is the normal behavior for the ntp client HP NonStop they use and must find a way to do it on all the other guests.

  I trawled autour and couldn't find an easy way to do this with esxi ntpd uses. The best I could think of would be to have infrastructure ntp sync for that provide customers (esx), but from the perspective of compliance that would not be cut.

  Apparently, it is a common requirement of compliance for the financial houses - anyone otherwise run into that, or have a solution?

  It seems that one of these requirements that no one knows everything

  As usual, all thoughts appreciated and rewarded with points

  The behavior you describe (drift toward the average of the reported servers) is the normal and expected of all implementations NTP appropriate.  (See http://web.archive.org/web/20100331222927/http :// www.sun.com/blueprints/0901/NTPpt3.pdf for an explanation of why this is the case - as part of the illustration on page 9 is one of the best things that you will ever make to understand NTP.)

  As near as I can tell, ESXi provides a fully operational server.  So all what you need to do is add three servers in the service host configuration screen and you will get this behavior.  You can verify the behavior by the running of "ntpq - pn IPaddress" from a local Linux machine against your ESXi host.  This is only an example of what mine looks like shortly after the time servers have been reconfigured and restarted ntpd:

  refid distance st t when poll reach delay offset jitter
  ==============================================================================
  192.168.240.254 203.192.179.98 3 u 37 64 101 1,229 60465,5 30179.7
  192.168.240.5 203.31.84.4 3 u 96 64 37 0.269 60338,7 30169.5
  192.168.240.249 192.189.54.17 3 100 64 37 0.229 u 60338,8 30169.4

  This server has been slower than the actual time of about 1 minute (60 000 milliseconds) and should start to drift toward it once it is synchronized to the top.

  Kind regards

  Paul

• Problems of time (NTP) on the virtual machines within ESXi 4

  I had synchronization problems of intermittent time with my computers running on ESXi4 for quite a while now.  I thought that there were problems with my VM themselves and made some changes that appear to clear things for awhile.  The problems are back, and I'm starting to wonder if this is something being induced with ESXi itself.  My configuration is:

  ESXi 4.1.0

  -2 x Windows domain controller

  -Exchange Server x 2

  -FreeNAS

  VMWare tools are installed on all windows boxes.  FreeNAS is running without installed VMTools.  Domain controllers are set to use time NTP, servo out of an internet time server.  Client Windows have the default configuration and should be pulling the exact time of one of the two domain controllers.  FreeNAS is taking time to DCs.  Often when problems begin with authentication, it is because of the difference in clock being too great between servers, or between the Server / client.

  Are there recommended solutions for these issues?  I dug through the forum messages and the KBs and found a good bit of info but nothing that does not seem to solve these problems.

  I recommend you to configure a time outside of your virtual environment for you server ESXi hosts.

  Imagine that nothing is under tension, and you begin to start.

  Your domain controller will begin with your host ESXi (UTC) time until it can connect to the Internet to update time.

  At this time most VMs are probably on the wrong time, and it creates a lot of problems.

  After the updating of the DC then only will be hosting ESXi synch at the exact time. Quite a turn messed up

  If your ESXi have an external NTP server, they boot with the exact time and start all the virtual machines with the exact time.

  It may be useful