Nešto raštimava sat na Windows Server-u 2008 R2

Nešto raštimava sat na Windows Server-u 2008 R2 14.12.2016. u 14:10 · pre 120 meseci #1

Na jednom Windows Server-u 2008 R2 se u toku dana raštima vrijeme nekoliko puta. Sama mašina je na malo daljoj lokaciji pa nisam uspio otići do nje, ali tu je remote pristup. Mislim da nije do baterije BIOS-a jer se ne izgube podešavanja, a ni vrijeme nego se vrijeme razdesi u toku rada. Nije da on linearno kasni nego radi dobro nekih dva tri sata pa odjednom pomjeri sat u nazad za pola sata, sat, nekada i sat i nešto minuta. Nema nekog pravlila. To znam jer sam napravio programčić koji svaki minut upiše u fajl vrijeme, a ovo je dio tog loga:

Code:

09.12.2016 13:51:30
09.12.2016 13:52:30
09.12.2016 13:53:30
09.12.2016 13:54:30
09.12.2016 13:55:30
09.12.2016 13:56:30
09.12.2016 13:57:30
09.12.2016 13:58:30
09.12.2016 13:59:30
09.12.2016 14:00:30
09.12.2016 14:01:30
09.12.2016 14:02:30 <---
09.12.2016 13:50:59
09.12.2016 13:51:59
.
.
.
09.12.2016 15:58:54
09.12.2016 15:59:54
09.12.2016 16:00:54
09.12.2016 16:01:54 <---
09.12.2016 15:33:30
.
.
.
09.12.2016 16:30:30
09.12.2016 16:31:30
09.12.2016 16:32:30 <--
09.12.2016 15:33:30
09.12.2016 15:34:30
09.12.2016 15:35:30
09.12.2016 15:36:30

Podešavao i sinhronizaciju sa servera time.windows.com, ali ne pije vode. Po klasičnim startup mjestima nema ničega spornog, u Task Scheduler ima samo backup podešen. Dalje nemam ideja.
Ovo se počelo dešavati neki dan.

Zna li neko šta bi ovo moglo biti?

Potpis

SELECT * FROM หน่วยงานหลัก WHERE ยสันติ LIKE 'โดย%'

Re: Nešto raštimava sat na Windows Server-u 2008 R2 14.12.2016. u 14:52 · pre 120 meseci #2

Pogledaj u Event Vieweru, trebalo bi da je u Windows Logs/Security u to vreme logovan događaj promene sistemskog vremena: https://www.ultimatewindowssec...opedia/event.aspx?eventID=4616

Npr:

Code:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{42145-DEAD-BEEF-BBCB-33111144}" />
  <EventID>4616</EventID>
  <Version>1</Version>
  <Level>0</Level>
  <Task>12288</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8020000000000000</Keywords>
  <TimeCreated SystemTime="2016-12-14T13:48:22.281875800Z" />
  <EventRecordID>20036</EventRecordID>
  <Correlation />
  <Execution ProcessID="2" ThreadID="11200" />
  <Channel>Security</Channel>
  <Computer>DESKTOP-6QI2C02</Computer>
  <Security />
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-#-#-#-#####-#####-#####-####</Data>
  <Data Name="SubjectUserName">######</Data>
  <Data Name="SubjectDomainName">DESKTOP-#####</Data>
  <Data Name="SubjectLogonId">xxxxxxxxxx</Data>
  <Data Name="PreviousTime">2016-12-14T13:48:22.282260800Z</Data>
  <Data Name="NewTime">2016-12-14T13:48:22.282000000Z</Data>
  <Data Name="ProcessId">0x2bfc</Data>
  <Data Name="ProcessName">C:\Windows\System32\SystemSettingsAdminFlows.exe</Data>  /* Ručno promenjen */
  </EventData>
  </Event>

Re: Nešto raštimava sat na Windows Server-u 2008 R2 14.12.2016. u 14:54 · pre 120 meseci #3

Da li je server kontroler domena?

Potpis

... Vladimir Vučićević aka. Bachi
~~~ www.bachi.in.rs <<<<>>>> [email protected]
>>> It's nice to be important, but it's more important to be nice...

Re: Nešto raštimava sat na Windows Server-u 2008 R2 14.12.2016. u 15:12 · pre 120 meseci #4

U Eventima pod Windows Log\Security nema nigdje zabilježeno pomijeranje vremena u nazad (ono što mene zeza), ali sam našao više ovakvih:

Code:

System
  - Provider
   [ Name]  Microsoft-Windows-Security-Auditing
   [ Guid]  {5484962...}
   EventID 4616
   Version 1
   Level 0
   Task 12288
   Opcode 0
   Keywords 0x8020000000000000
  - TimeCreated
   [ SystemTime]  2016-12-14T13:12:35.000000000Z
    EventRecordID 92178
    Correlation
   - Execution
   [ ProcessID]  4
   [ ThreadID]  84
   Channel Security
   Computer --------
   Security
- EventData
  SubjectUserSid S-1-5-21...
  SubjectUserName -------
  SubjectDomainName ------
  SubjectLogonId 0x147b43
  PreviousTime 2016-12-14T13:12:35.000000000Z
  NewTime 2016-12-14T13:12:35.000000000Z
  ProcessId 0xca4
  ProcessName C:\Windows\System32\rundll32.exe

- System
  - Provider
   [ Name]  Microsoft-Windows-Security-Auditing
   [ Guid]  {548496------}
   EventID 4616
   Version 1
   Level 0
   Task 12288
   Opcode 0
   Keywords 0x8020000000000000
  - TimeCreated
   [ SystemTime]  2016-12-14T13:12:35.000000000Z
   EventRecordID 92177
   Correlation
  - Execution
   [ ProcessID]  4
   [ ThreadID]  84
   Channel Security
   Computer ------
   Security
- EventData
  SubjectUserSid S-1-5-21------
  SubjectUserName nemanja
  SubjectDomainName ------
  SubjectLogonId 0x147b43
  PreviousTime 2016-12-14T12:46:42.078125000Z
  NewTime 2016-12-14T13:12:35.000000000Z
  ProcessId 0xca4
  ProcessName C:\Windows\System32\rundll32.exe

Ovaj drugi log (gore) je nastao kada sam ručno podesio vrijeme na pravo.

U windows Log\System:

Code:

- System
  - Provider
   [ Name]  Microsoft-Windows-Kernel-General
   [ Guid]  {A68C....}
   EventID 1
   Version 0
   Level 4
   Task 0
   Opcode 0
   Keywords 0x8000000000000010
  - TimeCreated
   [ SystemTime]  2016-12-14T13:12:35.500000000Z
    EventRecordID 133384
    Correlation
   - Execution
   [ ProcessID]  4
   [ ThreadID]  72
    Channel System
    Computer ------
   - Security
   [ UserID]  S-1-5-18
- EventData
  NewTime 2016-12-14T13:12:35.500000000Z
  OldTime 2016-12-14T14:02:59.421875000Z

Proces pod ID 4 je system

@bachi nije kontroler domena.

Potpis

SELECT * FROM หน่วยงานหลัก WHERE ยสันติ LIKE 'โดย%'

Forum kao aplikacija na telefonu

Srodne teme