Time service issues causing Domain trust relationship to be broken

[DPTech]

We have a select group of approximately 20+ domain computers having the same issue when they boot their computer in the mornings. The time changes back to the exact time when they shutdown the evening before. It appears that it begins to complete an incomplete shutdown, but users stating they are completing properly. My guess is that something is happening during the shutdown which never completes and Windows startup repair switches back to complete shutdown. Has anyone seen this before. It is also causing repeat Domain Trust Relationship issue beleived to be due to out of synch time. Logs below. Any help is greatly appreciated

Information 8/26/2013 9:06:14 AM Kernel-Processor-Power 26 (4)
Information 8/26/2013 9:06:14 AM Kernel-Processor-Power 26 (4)
Information 8/26/2013 9:06:14 AM Kernel-Processor-Power 26 (4)
Information 8/26/2013 9:06:14 AM Kernel-Processor-Power 26 (4)
Information 8/26/2013 9:06:13 AM MEI 2 None
Information 8/26/2013 9:06:13 AM VMnetAdapter 36 None
Information 8/26/2013 9:06:12 AM Kernel-Power 89 (86)
Information 8/26/2013 9:06:05 AM FilterManager 6 None
Information 8/26/2013 9:06:05 AM FilterManager 6 None
Information 8/26/2013 9:06:05 AM Kernel-General 12 None
Information 8/23/2013 5:24:18 PM Kernel-General 13 None
Information 8/23/2013 5:24:16 PM Kernel-Power 109 (103)
Information 8/23/2013 5:24:15 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:14 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:14 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:14 PM UserPnp 20010 (7010)
Information 8/23/2013 5:24:14 PM Service Control Manager 7036 None
Warning 8/23/2013 5:24:14 PM WLAN-AutoConfig 4001 None
Warning 8/23/2013 5:24:13 PM WLAN-AutoConfig 10002 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Kernel-General 1 None
Information 8/26/2013 9:06:21 AM EventLog 6013 None
Information 8/26/2013 9:06:21 AM EventLog 6005 None
Information 8/26/2013 9:06:21 AM EventLog 6009 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:12 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:12 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:12 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:12 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:11 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:11 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:11 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:11 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:11 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:11 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:11 PM Service Control Manager 7036 None

Thanks for looking and advising,
Dave

 

[Shadowjk]

What are your NTP servers and do the machines have access to them upon boot? For example if an internet source, do they have access upon boot?

This may be of use when setting up time pools on the DC - Configure a time server for Active Directory domain controllers - TechRepublic

Josh

 

[DPTech]

Thanks for the feedback Josh. Time service is managed by the DC's. This is roughly 20 machines experiencing this out of over 500. All of them having the time change during boot on network. Checked other machines and they boot normally without the time changing. I beleive this is what is causing them to lose domain trust because the time is so different than the DC. headscratcher for me.

 

[Shadowjk]

Have you tried forcing a resync of time with the DC?

Command prompt:

net time /domain

Josh

 

[chev65]

There are a few commands in the TechNet link to allow the client PC's to sync with the DC automatically. Might help strange problem so not too sure.

Configure a client computer for automatic domain time synchronization: Windows Time Service

 

[DPTech]

Thanks for the suggestions. They are configured for automatic time synch and appears to be working on boot as the report the correct time initially but then switch back to the shutdown time. The event logs show that when they revert back to the previous time the processes are performing service shutdowns as if it were trying to complete an improper shutdown. Could this be due to windows startup repair service? As you can see below the shutdown from the 23rd was shutting down at 5:24:13. Then user boots on the 26th at 9:06:21 and records 3 generic eventlog entries. The the system changes time back to 8/23/13 at 5:24:13. The same time that it was shutting down. The entris details when this happens are strange. The first entry after the time changes back is Kernel-General "The system time has changed to 2013-08-23T21:24:13.696117600Z. The next entry is Service Control Manager "The windows Time Service entered the stopped state". The following 16 events are all referring to stopping services like it is shutting down. then it reverts back to the correct time with a Kernel-General entry "The operating system started at system time 2013-08-26T13:06:05.125599400Z. Then in most cases the system will boot and operate properly, but sometimes it looses Trust relationship with Domain. Perplexing...

Information 8/26/2013 9:06:05 AM FilterManager 6 None
Information 8/26/2013 9:06:05 AM Kernel-General 12 None
Information 8/23/2013 5:24:18 PM Kernel-General 13 None
Information 8/23/2013 5:24:16 PM Kernel-Power 109 (103)
Information 8/23/2013 5:24:15 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:14 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:14 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:14 PM UserPnp 20010 (7010)
Information 8/23/2013 5:24:14 PM Service Control Manager 7036 None
Warning 8/23/2013 5:24:14 PM WLAN-AutoConfig 4001 None
Warning 8/23/2013 5:24:13 PM WLAN-AutoConfig 10002 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None
Information 8/23/2013 5:24:13 PM Kernel-General 1 None
Information 8/26/2013 9:06:21 AM EventLog 6013 None
Information 8/26/2013 9:06:21 AM EventLog 6005 None
Information 8/26/2013 9:06:21 AM EventLog 6009 None
Information 8/23/2013 5:24:13 PM Service Control Manager 7036 None