Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Synchronizing ESXi/ESX time with a Microsoft Domain Controller (1035833)

Last Updated: 2/9/2022Categories: Best PracticesTotal Views: 276087Language:
Chinese (Simplified)JapaneseSpanishEnglish

28 like this article

Subscribe to get an email
newsletter with new updates

28 people found this helpful Please provide article feedback:

Learn how VMware Skyline Advisor and Skyline Health Diagnostics work together to provide proactive intelligence and self-service log analysis.

Use Skyline Advisor to avoid issues before they occur across VCF, vSphere, vSAN, NSX, vROps & Horizon. Skyline Findings are based on top KBs, VMSAs/CVEs and design best practices.

Use Skyline Health Diagnostics to root cause vSphere & vSAN logs when an issue occurs. Skyline Health Diagnostic Findings are based on top KBs and VMSA/CVEs. You can use the Skyline Health Diagnostics tool in online or offline mode.

If you require additional help from technical support, please use Skyline Advisor to initiate a Log Assist to reduce time to upload logs. TSEs can also initiate logs to reduce effort.

Symptoms

An ESXi/ESX host configured to use a Microsoft Windows 2003 or newer Domain Controller as a time source never synchronizes its clock with a default configuration.

Resolution

Workaround

If you are using ESXi/ESX 4.1 Update 1 or later, you can use this workaround:

When using Active Directory integration in ESXi/ESX 4.1 and newer, it is important to synchronize time between ESXi/ESX and the directory service to facilitate the Kerberos security protocol.

You should leave the default settings when ESXi is joined to the domain and not to configure NTP, If you want to use NTP then the active directory server must be configured to use a reliable time source (NTP) itself.

ESXi/ESX support synchronization of time with an external NTPv3 or NTPv4 server compliant with RFC 5905 and RFC 1305. Microsoft Windows 2003 and newer use the W32Time service to synchronize time for windows clients and facilitate the Kerberos v5 protocol. For more information, see the Microsoft Knowledge Base article 939322 and How the Windows Time Service Works.

By default, an unsynced Windows server chooses a 10-second dispersion and adds to the dispersion on each poll interval that it remains in sync. An ESXi/ESX host, by default, does not accept any NTP reply with a root dispersion greater than 1.5 seconds.

The preceding links were correct as of April 16, 2013. If you find a link is broken, provide feedback and a VMware employee will update the link.

Configure Windows NTP Client

ESXi/ESX requires an accurate time source to synchronize with. To use a Windows 2003 or newer server, it should be configured to get its time from an accurate upstream NTP server. For more information, see the Microsoft Knowledge Base article 816042.

The preceding link was correct as of April 16, 2013. If you find a link is broken, provide feedback and a VMware employee will update the link.

Use the registry editor on the Windows server to make the configuration changes:

Note: This procedure modifies the Windows registry. Before making any registry modifications, ensure that you have a current and valid backup of the registry and the virtual machine.

Enable NTP mode:

Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

Set the Type value to NTP.

Enable the NTP Client:

Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config

Set the AnnounceFlags value to 5.

Specify the upstream NTP servers to sync from:

Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders

Set the NtpServer value to a list of at least 3 NTP servers.

Example: You might set the value to:

1.pool.ntp.org,0x1 2.pool.ntp.org,0x1 3.pool.ntp.org,0x1

Note: On a Windows 2008 Domain Controller, NtpServer is located in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters.

Specify a 15-minute update interval:

Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient

Set the SpecialPollInterval value to 900.

Restart the W32time service for the changes to take effect.

Configure ESXi/ESX NTP and Likewise Clients

vSphere Client

Configure ESXi/ESX to synchronize time with the Windows server Active Directory Domain Controller:

Connect to the ESXi/ESX host or vCenter Server using the vSphere Client.

Click the ESXi/ESX host in the inventory.

Click the Configuration tab.

Under the Software heading, click Time Configuration.

Click Properties.

Ensure that the NTP Client Enabled option is selected.

Click Options.

Click NTP Settings.

Click Add and specify the fully qualified domain name or IP address of the Windows server Domain Controller(s).

Click OK.

Click OK to save the changes.

vSphere Web Client

Log in to the vSphere Web Client with administrator credentials.

Click on Hosts and Clusters.

Select the ESXi host from the list

Click Manage > Settings.

Expand System and select Time Configurations.

Click Edit.

Enter the Windows server Domain Controller(s) information.

Additional configuration must be done from the command line.

ESX/ESXi 4.x and 5.x

Open a console to the ESXi/ESX host. For more information, see Connecting to an ESX host using a SSH client (1019852) or Using Tech Support Mode in ESXi 4.1 and ESXi 5.0 (1017910).

Open the /etc/ntp.conf file in a text editor. For more information, see Editing configuration files in VMware ESXi and ESX (1017022).

Add the tos maxdist command on its own line:

tos maxdist 30

Save and close the configuration file.

Make the /etc/likewise/lsassd.conf file writable by running the command:

chmod +w /etc/likewise/lsassd.conf

Open the /etc/likewise/lsassd.conf file in a text editor. For more information, see Editing configuration files in VMware ESXi and ESX (1017022).

Locate the sync-system-time option, uncomment it, and set the value to no:

sync-system-time = no

Save and close the configuration file.

On ESXi, save the configuration changes to the boot bank so they persist across reboots by running the command:

/sbin/auto-backup.sh

Restart the ntpd and lsassd services for the configuration changes to take effect by running the commands:

service lsassd restart
service ntpd restart

Note: To restart the ntpd and lsassd services on an ESXi host, run these commands:

/etc/init.d/lsassd restart
/etc/init.d/ntpd restart

If the ntpd and lsassd services do not restart, consider restarting the management agents first. For more information about restarting the management agents, see Restarting the Management agents on an ESX or ESXi Server (1003490).

ESXi 6.x/ 7.0.1/ 7.0.2

Connect to the ESXi host using an SSH session. For more information, see Using ESXi Shell in ESXi 5.x and 6.0 (2004746).

Open the /etc/ntp.conf file in a text editor. For more information, see Editing configuration files in VMware ESXi and ESX (1017022).

Add the tos maxdist command on its own line:

tos maxdist 30

Save and close the configuration file.

Run this command to access the likewise shell:

/usr/lib/vmware/likewise/bin/lwregshell

Note: If the command fails with the error:

lwregshell (error = 40700 - LWREG_ERROR_NO_SUCH_KEY_OR_VALUE)

Run this command to start the likewise service and then run the command to access the likewise shell:

/etc/init.d/lwsmd start

Navigate to the HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory directory with this command:

cd HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory

Run this command to change the synchronization time:

set_value SyncSystemTime 0

Exit the shell by typing quit and pressing Enter.

Refresh the lsass service with this command:

/usr/lib/vmware/likewise/bin/lwsm refresh lsass

For example:

/usr/lib/vmware/likewise/bin/lwsm refresh lsass

Refreshing service: lsass

To verify the changes to the registry key, run this command:

/usr/lib/vmware/likewise/bin/lwregshell list_values "[HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory]"

ESXi 7.0.3, see vSphere ESXi 7.0 U3 and later versions NTP configuration steps loading a text file containing NTP configuration commands (87488)

Once the configuration changes are complete, ensure that the time is synchronized between the ESXi/ESX host and the Windows server. For more information, see Troubleshooting NTP on ESX and ESXi (1005092).

Related Information

vSphere ESXi 7.0 U3 and later versions configuration files for NTP and PTP can no longer be edited (87176)
Restarting the Management agents in ESXi
Troubleshooting NTP on ESX and ESXi 4.x / 5.x / 6.x
Editing configuration files in VMware ESXi and ESX
Using Tech Support Mode in ESXi 4.1, ESXi 5.x, and ESXi 6.x
Connecting to an ESX host using an SSH client
Installing and Configuring NTP on an ESX host
Using ESXi Shell in ESXi 5.x and 6.x
Sincronización de tiempo de ESXi/ESX con Microsoft Domain Controller
Microsoft ドメイン コントローラを使用して ESXi/ESX の時刻を同期する
使 ESXi/ESX 时间与 Microsoft 域控制器同步

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseSpanishEnglish

Attachments

Additional Resources

No results for undefined

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware vSphere

VMware ESX Server

Related Versions:

VMware vSphere ESXi 6.7

VMware vSphere ESXi 6.5

VMware vSphere ESXi 6.0

VMware vSphere ESXi 5.5

VMware vSphere ESXi 5.1

VMware vSphere ESXi 5.0

VMware vSphere 7.0.x

VMware ESXi 4.1.x Installable

VMware ESXi 4.1.x Embedded

VMware ESX Server 3.5.x

VMware ESX Server 3.0.x

VMware ESX Server 2.5.x

VMware ESX Server 2.1.x

VMware ESX Server 2.0.x

VMware ESX Server 1.x

VMware ESX Server 1.x

VMware ESX Server 1.5.x

VMware ESX 4.1.x

view all

Take Our Survey

Support Assistant