Page 1 of 1

Time Sync via WMI Intermittent Offset

Posted: Tue Jul 20, 2021 12:51 pm
by pcappell
Good Afternoon,

We are currently experiencing a problem with an NTP service check against Windows Server 2019 servers via WMIC.
Most of the time, they show an acceptable time offset, but every few minutes it will flip to a -1 hour NTP offset, causing a critical alert.

This check is being performed via a .bash script which executes the following command to retrieve the NTP offset:

Code: Select all

wmic --option="client ntlmv2 auth"=Yes -U $USERNAME%$PASSWORD //$HOSTNAME "select LocalDateTime from win32_operatingsystem"
I was wondering if there have been any other reports of this intermittent behavior with Windows Server 2019?
We will also be submitting a support ticket with Microsoft.

Best,
Paul

Re: Time Sync via WMI Intermittent Offset

Posted: Tue Jul 20, 2021 2:57 pm
by mcapra
pcappell wrote:but every few minutes it will flip to a -1 hour NTP offset, causing a critical alert.
Does the flip coincide with any of the poll intervals set in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\? That's something to consider when troubleshooting "Windows NTP weirdness".

I'd definitely start logging W32Time things if you aren't already:
https://docs.microsoft.com/en-us/troubl ... me-service

It would surprise me if this was at all related to wmic.

Re: Time Sync via WMI Intermittent Offset

Posted: Wed Jul 21, 2021 10:13 am
by gsmith
Hi

The registry value for UpdateInterval is 30000. My guess is that is 5 minutes.

Did you hear anything from Microsoft? If you don't you may need to start the logging
as mcapra mentions. That would enable us to see if the data is causing the one hour
flip.

Let me know what you find out please.

Thanks

Re: Time Sync via WMI Intermittent Offset

Posted: Fri Jul 23, 2021 9:25 am
by pcappell
Hello,

I have been informed by our server administrators that the UpdateInterval in the registry is 100 and have passed that Microsoft document over to them.

Best,
Paul

Re: Time Sync via WMI Intermittent Offset

Posted: Fri Jul 23, 2021 9:33 am
by gsmith
Hi,

Sounds good. Let me know what the Microsoft logs show after they have gathered some data.

Thanks