vSAN helath Alarm "Time is synchronized across hosts and VC" occured.

Products

• VMware vSAN

Issue/Introduction

vSAN helath "Time is synchronized across hosts and VC" occured.
There is a problem with one of the two registered NTP servers, and the time in the vCenter Server is 3 minutes ahead of the ESXi host.
However, even if perform the following actions, the time is drifted by 3 minutes.

・ Restarted vCenter
・ Removed the wrong NTP server registration from vCenter management interface.
・ Changed the time synchronization mode in vCenter from "NTP" to "Host."
-> When these are done, the time is corrected, but after a while it will be drifted by 3 minutes.

Environment

vCenter Server 7.0

vCenter Server 8.0

Cause

The vCenter Server is participating in Active Directory and synchronized the time with the domain controller, which also served as an NTP server.

How to check the Active Directory time synchronization setting in vCenter Server
1. Log in to vCenter Server via SSH.
2. Check the value of "SyncSystemTime" using the following command:
   /opt/likewise/bin/lwregshell list_values ​​'[HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory]' | grep -i SyncSystemTime
   "SyncSystemTime" REG_DWORD 0x00000001 (1)   <- Enabled

 

Resolution

Disable the Active Directory time synchronization setting in the vCenter Server

1. Log in to vCenter Server via SSH.
2. Access the likewise shell:
  /usr/lib/vmware/likewise/bin/lwregshell
3. Navigate to the HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory directory with this command:
  cd HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory
4.Run this command to change the synchronization time:
  set_value SyncSystemTime 0
5. Exit the shell by typing quit and pressing Enter.
6. Refresh the lsass service with this command:
  /usr/lib/vmware/likewise/bin/lwsm refresh lsass
7. To verify the changes to the registry key, run this command:
  /usr/lib/vmware/likewise/bin/lwregshell list_values "[HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory]" | grep -i SyncSystemTime
  "SyncSystemTime"                         REG_DWORD       0x00000000 (0)

Additional Information

This "SyncSystemTime" setting has been disabled by default in vCenter 7.0U2 and later releases.
However, If vCenter server is updated from a version earlier than the above, the setting remains valid.

vSAN Skyline Health Alert: "Time is synchronized across hosts and VC"