Unwanted synchronization of time

Imagine following situation. You have virtual machine on VMware and clock are from time to time automaticaly sync, but not with NTP source you have, but from different source. First thing which will come to your mind is, lets check checkbox on Vmware which is enabling or disabling synchronization with host. But you will find out, that checkbox is unchecked.

So lets start the troubleshooting.

Open event viewer, go to system events and filter event ID 1, source Kernel-General
You will see something like this

You see the prove, that „something“ is changing time. So lets review setting of NTP client
Open CMD and run follwoing command

w32tm /query /status

Result is something like this:

You see, that IP and source are correct and in case of domain joined computer, you will see probably IP and FQDN of your domain controller.

Ok, now we know that NTP server is set correctly, but our computer still getting the time from different source.

To be able to find, what process is calling time change, you will need to enable Audit privilege use and then search for event ID 4616

Run the Local Security Policy (secpol.msc), and go to Local Policies\Audit Policy, open Audit privilege use and check Success checkbox.

Once the auditing will be enabled, we have to wait untli time change will occure. Then search in Security log event id 4616.

BOOOM! we found the root cause! vmtoolsd.exe alias VMware

Ok, now its comming question, how is possible, that time is change by VMware even if I have this setting disabled?

I found article on VMware, that this can sometimes happen. Especially time is resynchronized when you migrate the virtual machine using vMotion, take a snapshot, restore to a snapshot, shrink the virtual disk, or restart the VMware Tools service in the virtual machine (including rebooting the virtual machine).

To completly disable time synchronization, we need to do change on VMware VM. More infomration here.

1. Select the virtual machine in the vSphere Web Client inventory and power it off.
2. Right click the virtual machine and choose Edit Settings…
3. Click the VM Options tab.
4. Expand the Advanced option.
5. Under Configuration Parameters click Edit Configuration.
6. Click Add Row and add this information

Note: When adding tools.syncTime via the Configuration Parameters in vSphere 5.x, it is not displayed again after the entry has been accepted and closed. When you view the vm_name.vmx file, you see the parameter inserted as tools.syncTime = "FALSE".