Time Drift reported with vCenter Standalone and vCenter's configured on Enhanced Linked Mode

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

• Likewise expects the vCenter and the Active Directory domain time to be synced within ±5mins so that the Kerberos authentications work fine
• For this vCenter continuously checks the Domain Controller time and tries to update the vCenter clock in case of a difference in the time
• It has been observed that when both NTP and Active Directory is configured on VC/ESX we start seeing these kind of time configuration issues

Environment

VMware vCenter Server 7.0.1
VMware ESXi 6.5.x
VMware vCenter Server 6.7.x
VMware ESXi 6.7.x

Resolution

• To avoid this particular issue, time sync in Likewise can be disabled on VC using the following steps:
  • Disable time sync using the command: /opt/likewise/bin/lwregshell set_value '[HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory]' SyncSystemTime 0
  • Restart Likewise using: /opt/likewise/bin/lwsm restart lwreg
• The time drift issue on vCenter should be resolved
• This particular setting has been disabled by default in vCenter 7.0U2 and later releases.