vCenter time is intermittently out of sync

Products

• VMware vCenter Server

Issue/Introduction

• vCenter time is intermittently out of sync
• vCenter is joined to Active Directory
• NTP is configured to sync from one of the Domain Controllers
• There are more than one Domain Controllers in the environment
• Domain Time and VC time looks same when verified with this command
  /opt/likewise/bin/lw-get-dc-time example-domain.local && date
  
  Output:
  DC TIME: YYYY-MM-DD HH:MM:SS UTC
  Day Mon DD HH:MM:SS PM UTC YYYY

Cause

If vCenter is joined to Active Directory Domain, VC is expected to sync time from any of the Domain Controllers in the AD Domain omitting the NTP Server configured in VAMI. In case of any of the Domain Controllers' time is out of sync, you would see the time drift issue in vCenter. 

Resolution

In order to solve this issue, verify the time on every Domain Controllers in the Domain and correct the time on Domain Controller/s.

Workaround:

Note: This workaround will prevent vCenter logons with Domain User Accounts if the VC is configured to use Integrated Windows Authentication. Proceed with this workaround only if you are using LDAP, LDAPS, Open LDAP, or other Identity Federations on vCenter.  

Leave vCenter from AD Domain by following the below steps.

• SSH in to vCenter
• Execute the command '/opt/likewise/bin/domainjoin-cli leave'
• Restart vCenter appliance by executing 'reboot' command