Synchronize ESXi/ESX time with a Microsoft Domain Controller
When using Active Directory integration in ESXi/ESX 4.1 and newer, it is important to synchronize time between ESXi/ESX and the directory service to facilitate the Kerberos security protocol.
ESXi/ESX support synchronization of time with an external NTPv3 or NTPv4 server compliant with RFC 5905 and RFC 1305. Microsoft Windows 2003 and newer use the W32Time service to synchronize time for windows clients and facilitate the Kerberos v5 protocol. For more information, see the Microsoft Knowledge Base article 939322 and How the Windows Time Service Works.
By default, an unsynced Windows server chooses a 10-second dispersion and adds to the dispersion on each poll interval that it remains in sync. An ESXi/ESX host, by default, does not accept any NTP reply with a root dispersion greater than 1.5 seconds.
Configure Windows NTP Client:
ESXi/ESX requires an accurate time source to synchronize with. To use a Windows 2003 or newer server, it should be configured to get its time from an accurate upstream NTP server
Use the registry editor on the Windows server to make the configuration changes:
Enable NTP mode:
Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
Set the Type value to NTP.
Enable the NTP Client:
Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
Set the AnnounceFlags value to 5.
Specify the upstream NTP servers to sync from:
Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders
Set the NtpServer value to a list of at least 3 NTP servers.
Example: You might set the value to:
1.pool.ntp.org,0x1 2.pool.ntp.org,0x1 3.pool.ntp.org,0x1
Note: On a Windows 2008 Domain Controller, NtpServer is located in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters.
Specify a 15-minute update interval:
Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
Set the SpecialPollInterval value to 900.
Restart the W32time service for the changes to take effect.
Configure ESXi/ESX NTP and Likewise Clients
vSphere Client
Configure ESXi/ESX to synchronize time with the Windows server Active Directory Domain Controller:
- Connect to the ESXi/ESX host or vCenter Server using the vSphere Client.
- Click the ESXi/ESX host in the inventory.
- Click the Configuration tab.
- Under the Software heading, click Time Configuration.
- Click Properties.
- Ensure that the NTP Client Enabled option is selected.
- Click Options.
- Click NTP Settings.
- Click Add and specify the fully qualified domain name or IP address of the Windows server Domain Controller(s).
- Click OK.
- Click OK to save the changes.
vSphere Web Client
- Log in to the vSphere Web Client with administrator credentials.
- Click on Hosts and Clusters.
- Select the ESXi host from the list
- Click Manage > Settings.
- Expand System and select Time Configurations.
- Click Edit.
- Enter the Windows server Domain Controller(s) information.
Additional configuration must be done from the command line.
ESX/ESXi 4.x and 5.x
Open a console to the ESXi/ESX host. For more information, see Connecting to an ESX host using a SSH client (1019852) or Using Tech Support Mode in ESXi 4.1 and ESXi 5.0 (1017910).
Open the /etc/ntp.conf file in a text editor. For more information, see Editing configuration files in VMware ESXi and ESX (1017022).
Add the tos maxdist command on its own line:
tos maxdist 30
Save and close the configuration file.
Make the /etc/likewise/lsassd.conf file writable by running the command:
chmod +w /etc/likewise/lsassd.conf
Open the /etc/likewise/lsassd.conf file in a text editor.
Locate the sync-system-time option, uncomment it, and set the value to no:
sync-system-time = no
Save and close the configuration file.
On ESXi, save the configuration changes to the boot bank so they persist across reboots by running the command:
/sbin/auto-backup.sh
Restart the ntpd and lsassd services for the configuration changes to take effect by running the commands:
service lsassd restart
service ntpd restart
Note: To restart the ntpd and lsassd services on an ESXi host, run these commands:
/etc/init.d/lsassd restart
/etc/init.d/ntpd restart
If the ntpd and lsassd services do not restart, consider restarting the management agents first. For more information about restarting the management agents, see Restarting the Management agents on an ESX or ESXi Server (1003490).
ESXi 6.0
Connect to the ESXi host using an SSH session. For more information, see Using ESXi Shell in ESXi 5.x and 6.0 (2004746).
Open the /etc/ntp.conf file in a text editor. For more information, see Editing configuration files in VMware ESXi and ESX (1017022).
Add the tos maxdist command on its own line:
tos maxdist 30
Save and close the configuration file.
Run this command to access the likewise shell:
/usr/lib/vmware/likewise/bin/lwregshell
Note: If the command fails with the error:
lwregshell (error = 40700 – LWREG_ERROR_NO_SUCH_KEY_OR_VALUE)
Run this command to start the likewise service and then run the command to access the likewise shell:
/etc/init.d/lwsmd start
Navigate to the HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory directory with this command:
cd HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory
Run this command to change the synchronization time:
set_value SyncSystemTime 0
Exit the shell by typing quit and pressing Enter.
Refresh the lsass service with this command:
/usr/lib/vmware/likewise/bin/lwsm refresh lsass
For example:
/usr/lib/vmware/likewise/bin/lwsm refresh lsass
Refreshing service: lsass
To verify the changes to the registry key, run this command:
/usr/lib/vmware/likewise/bin/lwregshell list_values “[HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory]”
Once the configuration changes are complete, ensure that the time is synchronized between the ESXi/ESX host and the Windows server. For more information, see Troubleshooting NTP on ESX and ESXi (1005092).
Source: Synchronizing ESXi/ESX time with a Microsoft Domain Controller (1035833) | VMware KB
guynaftaly 