Enabling Hyper-V Integrated Services Time Sync Services versus Internet Time Synchronization

hyper-vtime-synchronization

Should I deselect the "Synchronize with an Internet Time Server" checkbox under the VM's "Date and Time -> Internet Time Settings" tab if the "Time Synchronization Service" for a Hyper-V-based Virtual Machine is enabled?

One of the Integration Services that Hyper-V provides is the Time Synchronization Service, which can be enabled/disabled by going to a VM's Settings->Integration Services setting in the Management section. I believe this is checked by default.

When you install a Windows Server 2008 OS in a VM on the Hyper-V server, it comes with the "Synchronize with an Internet Time Server" option set, pointing to "time.windows.com".

I'd think that if the parent Hyper-V server is set to one time server, and the child VM is pointing to a different time server, there would be a momentary blip if the two are not spot on with their times when the synchronization services run.

So the question is, which time sync service should I use? I'm assuming not both. And what is the advantage of one over the other?

Note: This question assumes that the machines are not joined to a domain. If they were, the machines would also try to update their time against the domain controller with the primary domain controller role too, right?

Thanks!

Best Answer

So the question is, which time sync service should I use?

Hyper-V. The clock on a vm can get out of sync VERY fast. Most modern OS (and this includes windows) rely on a software clock, which - sadly - is unstable on a VM. It will fall behind in the VM can not allocate it enough CPU slices, which it assumes to have. Hyper-V is resyncing VERY often.

Related Solutions

Windows – Time sync fails on Hyper-V VM, but succeeds when I log in as a domain user

What i learned from experience on the field: -Sync all hypervisor to your DC (create a round robin dns like ntp.mydomain.local to each DC) -The DC that has the fsmo "pdc emulator" must sync to an official ntp server. Only him must do that. -all DC running as VM mustn't sync time through hyper-v or vmware tools.

When a VM start, hypervisor emulate a bios, with a time and date. This is taken from the current date & time of the hypervisor. That's why they must on time, and especially on AD time, even if they are workgroup.

More than 5mn difference will break kerberos by default.

Check for time on all hypervisor and DC.

Here is a poor script i use that give offset between computers and a reference one (choose the dc with pdc emulator FSMO): (long line). Must have psexec on the current folder, and feed servers.txt with one server per line to checkup

for /f %s in (servers.txt) do echo %s >> ntp_stripchart.txt && psexec \\%s w32tm /stripchart /computer:myspecialDC /period:1 /dataonly /samples:1 >> ntp_stripchart.txt && echo -------- >> ntp_stripchart.txt

How to re-enable the VM IC Time Synchronization Provider for a Hyper-V client

The best practice for time sync on Hyper-V is:

For Domain Controllers: Disable Hyper-V time sync inside the guest, but leave Hyper-V time sync enabled on the virtual machine configuration in the Hyper-V management console. This way Hyper-V sets the clock when the guest boots or resumes from a pause, but during normal operation the guest is responsible for its own clock. Use this command on the guest to stop it from using VM IC:

reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider /v Enabled /t reg_dword /d 0

(For a domain controller, it is important that it be responsible for its own time sync because AD needs to know the quality of the time. If the guest is managing the clock, it has access to the quality indicator of the network time. But if Hyper-V is managing the clock, then the guest sees the clock as an authoritative clock and always assumes it's correct, even when it's not.)

For all other guests: Use the Hyper-V guest additions to sync the clock. If the guest does not have additions installed then use the hardware clock, which the Hyper-V hypervisor will emulate.

Since in your case you've monkeyed with the time sync settings on your DC guests, I suggest that you reset your w32time settings first, then reinstall the guest additions, and finally apply the registry setting above.

Related Topic