Jorge's Quest For Knowledge!

About Windows Server, ADDS, ADFS, Azure AD, FIM/MIM & AADSync (Just Like An Addiction, The More You Have, The More You Want To Have!)

(2013-11-17) Time Sync Recommendations For Virtual DCs On Hyper-V – Change In Recommendations (AGAIN)

Posted by Jorge on 2013-11-17


The default time synchronization hierarchy within any AD forest is shown in the picture below.

image_thumb7

Figure 1: Default Time Synchronization Hierarchy Within Any AD Forest

-

As displayed in figure 1, DCs have their own time synchronization mechanism. When virtualizing DCs the time synchronization mechanism between the virtual DC (the VM guest) and the VM host must be disabled and it must be ensured the time synchronization mechanism natively used by the DCs is NOT disturbed. Reasoning for this is the high dependency that other processes (e.g. replication, authentication, etc.) have with accurate time.

-

OLD RECOMMENDATIONS:

  • Disable “Time Synchronization” within the Hyper-V Integration Services for each virtual DC VM (VM must be OFFLINE for this!)

image14

Figure 2: Hyper-V Time Synchronization Services In DISABLED State

-

  • Disable the “VM IC Time Provider” on every virtual DC through the registry or through a custom GPO setting
    • Key: HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider
    • Name: Enabled
    • Type: REG_DWORD
    • Data: 0x00000000

-

PREVIOUS RECOMMENDATIONS:

  • Leave “Time Synchronization” within the Hyper-V Integration Services ENABLED (DO NOT DISABLE!) for each virtual DC VM (VM must be OFFLINE for this!)
    REMARK: Microsoft documentation or other blogs may still advise in disabling time sync with the host. That information is incorrect! Leave it enabled!
  • Disable the “VM IC Time Provider” on every virtual DC through the registry or through a custom GPO setting
    • Key: HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider
    • Name: Enabled
    • Type: REG_DWORD
    • Data: 0x00000000

-

NEW RECOMMENDATIONS:

  • Disable “Time Synchronization” within the Hyper-V Integration Services for each virtual DC VM (VM must be OFFLINE for this!)

image14

Figure 3: Hyper-V Time Synchronization Services In DISABLED State

-

UPDATE (2013-12-14): make sure to have the following hotfix (KB2902014) if the Hyper-V host is running WIN8 or W2K12

-

Additional information about configuring Time Sync for DCs can be found through the following links:

-

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

About these ads

6 Responses to “(2013-11-17) Time Sync Recommendations For Virtual DCs On Hyper-V – Change In Recommendations (AGAIN)”

  1. […] UPDATED: (2013-11-17) Time Sync Recommendations For Virtual DCs On Hyper-V – Change In Recommendations (AGA… […]

  2. Abhishek said

    Nice Article. Does these recommendations apply to Virtual DC’s running in VMWARE too?
    Regards,
    Abhishek

  3. Jorge,

    What has prompted this “new” change in the time configuration?

    I have been using the “previous” configuration since virtualising my DC’s.

    I’d be interested to know what has changed.

    Regards,

    Jon

  4. Srdjan Maksimovic said

    How about virtual DC holding PDC role in an isolated network environment? This means that all virtual machines, including PDC owner, do not have access to internet and external NTP servers, because they are connected to an internal virtual network? Should PDC emulator sync its time with host OS in such topology or not?

  5. […] Time Sync Recommendations For Virtual DCs On Hyper-V – Change In Recommendations (AGAIN) […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: