question

JackChuong-8462 avatar image
0 Votes"
JackChuong-8462 asked JackChuong-8462 answered

Domain controller - Time changing automatically problem

Hi all,
here my environment:

3 sites/locations :

Default-First-Site-Name (Data center) :
2 domain controllers : dc1 (Windows Server 2016 Standard) holds 5 FSMO roles (PDC), dc2 (Windows Server 2012 R2 Standard) , Forest/Domain function level : Windows Server 2008 R2.

South site : 1 domain controller dc-south (Windows Server 2016 Standard)

North site : 1 domain controller dc-north (Windows Server 2012 R2 Standard)

All DCs are virtual machines (VMWare) , our timezone : GMT+7
Recently, my dc-south time is changed erratically (right -> wrong then wrong -> right)
95796-1.png


95797-2.png


95812-3.png


95813-4.png


95649-5.png


95650-6.png


There is another virtual machine placed same physical host with dc-south (not joined domain) and its time is fine, other DCs time are fine.
Our settings are as default , as MS documents , primary domain controller (PDC - my dc1) does not synchronize time with an external time source , it uses local clock, other DCs synchronize time from PDC , workstation clients/other servers (joined domain) synchronize time from nearest DC at their site.
dc1

 w32tm /query /status
 Leap Indicator: 0(no warning)
 Stratum: 1 (primary reference - syncd by radio clock)
 Precision: -6 (15.625ms per tick)
 Root Delay: 0.0000000s
 Root Dispersion: 10.0000000s
 ReferenceId: 0x4C4F434C (source name:  "LOCL")
 Last Successful Sync Time: 5/12/2021 2:35:29 AM
 Source: Free-running System Clock
 Poll Interval: 6 (64s)

dc2

 w32tm /query /status
 Leap Indicator: 0(no warning)
 Stratum: 2 (secondary reference - syncd by (S)NTP)
 Precision: -6 (15.625ms per tick)
 Root Delay: 0.0312500s
 Root Dispersion: 10.2717954s
 ReferenceId: 0xC0A80068 (source IP:  192.168.0.104)
 Last Successful Sync Time: 5/11/2021 8:46:12 AM
 Source: dc1.mydomain.com
 Poll Interval: 10 (1024s)

dc-south

 w32tm /query /status
 Leap Indicator: 0(no warning)
 Stratum: 2 (secondary reference - syncd by (S)NTP)
 Precision: -6 (15.625ms per tick)
 Root Delay: 0.0040861s
 Root Dispersion: 10.4064500s
 ReferenceId: 0xC0A80068 (source IP:  192.168.0.104)
 Last Successful Sync Time: 5/12/2021 11:25:23 AM
 Source: dc1.mydomain.com
 Poll Interval: 10 (1024s)

dc-north

 w32tm /query /status
 Leap Indicator: 0(no warning)
 Stratum: 2 (secondary reference - syncd by (S)NTP)
 Precision: -6 (15.625ms per tick)
 Root Delay: 0.0312500s
 Root Dispersion: 10.2620506s
 ReferenceId: 0xC0A80068 (source IP:  192.168.0.104)
 Last Successful Sync Time: 5/11/2021 8:41:13 AM
 Source: dc1.mydomain.com
 Poll Interval: 10 (1024s)

A workstation at south site

 w32tm /query /status
 Leap Indicator: 0(no warning)
 Stratum: 3 (secondary reference - syncd by (S)NTP)
 Precision: -23 (119.209ns per tick)
 Root Delay: 0.0072910s
 Root Dispersion: 10.5137854s
 ReferenceId: 0xC0A80767 (source IP:  192.168.7.103)
 Last Successful Sync Time: 5/12/2021 11:32:29 AM
 Source: dc-south.mydomain.com
 Poll Interval: 12 (4096s)

How can I find out what was causing the problem with dc-south time and fix it ? Please give me some advice, thank you very much.

windows-server-2016
1.png (48.7 KiB)
2.png (43.2 KiB)
3.png (51.9 KiB)
4.png (47.8 KiB)
5.png (56.3 KiB)
6.png (59.8 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JackChuong-8462 avatar image
0 Votes"
JackChuong-8462 answered

Problem solved by Disabling Time Synchronization, thank you very much.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

FanFan-MSFT avatar image
0 Votes"
FanFan-MSFT answered

Hi,
First, make sure that all the virtual machines are not synchronizing time from host.

The virtual PDC emulator must always synchronize the time with an external source, and the time synchronization with the host must be disabled. This also applies to any other VMs joined to the domain.
To do this:
Disable time synchronization with the host via the registry:
Set the Enabled parameter to 0 in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider
Note, before change a registry, please backup the registry.

If you have already disabled the time sync from host, then we can try to figure out the cause by collecting the debug logs and enabling the audit policy.
1. Please enable W32Time debugging log on your server that is reporting this error.
 
Collect the debug logs (the log analyze was not supported due to security reason)
(1). Click the Start Menu, in Run, type regedit and press Enter.
(2). Locate to the following key
 
HKey_Local_Machine\System\CurrentControSet\Services\W32Time\Config
 
(3). On the Edit menu, click New Value, and then add the following registry values:
 
Value Name: FileLogSize
Data Type: DWORD
Value data: 0x10000000
 
Value name: FileLogName
Data Type: String
Value data: C:\Windows\Temp\w32time.log
 
Value name: FileLogEntries
Data Type: String
Value: 116
 
(4). Restart Windows Time service.
(5). After that please closely monitor the event log. After this W32Time error appear again, please go to the folder C:\Windows\Temp, find w32time.log and upload it to our workspace below.
Run the following command to create the debug logs.
net stop w32time
net start w32time
w32tm /resync /nowait

2, Enabling the audit policy on all the DCs or the problematic DC.
95877-5123.jpg
Update the policy, once the issue re-happens, the events will be logged.


Best Regards,



5123.jpg (97.0 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JackChuong-8462 avatar image
0 Votes"
JackChuong-8462 answered

My PDC emulator is using local clock, it may be a few minutes wrong from real time but it is ok with me.
On my dc-south I did :

 Disable time synchronization with the host via the registry:
 Set the Enabled parameter to 0 in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider

  • Enable W32Time debugging log and enabling the audit policy , restart Windows Time service , file C:\Windows\Temp\w32time.log was created . W32Time error appear 2 times last night , but I don't find any useful information from w32time.log (only 3KB, I don't know why) , here is it (I cover my dc name)



           153533 06:59:10.0791248s - ---------- Log File Opened -----------------
             153533 06:59:18.0026947s - Association: (Local) 0.0.0.0:123 => 192.168.0.104:123 (Remote)
             153533 06:59:18.0027615s - Created reachability group: (
             153533 06:59:18.0027861s - 192.168.0.104:123,
             153533 06:59:18.0028054s - )
             153533 06:59:18.0029071s - Reachability: Attempting to contact peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123).
             153533 06:59:18.0198296s - Reachability:  removing peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123).  LAST PEER IN GROUP!
             153533 06:59:19.9388040s - Association: (Local) 0.0.0.0:123 => 192.168.0.104:123 (Remote)
             153533 06:59:19.9388323s - Created reachability group: (
             153533 06:59:19.9388431s - 192.168.0.104:123,
             153533 06:59:19.9388522s - )
             153533 06:59:19.9388904s - Reachability: Attempting to contact peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123).
             153533 06:59:19.9441066s - Reachability:  peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123) is reachable.
    
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

FanFan-MSFT avatar image
0 Votes"
FanFan-MSFT answered FanFan-MSFT commented

Hi,

1, From the debug log you shared, the south-DC tried to synchronize time with PDC but failed to contact with it, so it removed DC1 from the time source.
Then, one minute later, it connected with PDC successfully.
It may explain why the time changed to the wrong time and to right time again.
To get more information in the debug log, let try to change the value from 116 to 0-116 for the following entry:
Value name: FileLogEntries
Data Type: String
Value:0-116
2, Enable the audit policy as mentioned above.
96187-5133.jpg
3, In the domain, it is suggested to use the NT5DS to sync time instead of NTP. (Except PDC)
Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type
Key Name: Type
Type: REG_SZ(String Value)
Data: NT5DS

Best Regards,


5133.jpg (88.0 KiB)
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I enabled the audit policy (success and failure) at first time.
I updated registry FileLogEntries value to "0-116" , more log coming , will let you know later, if log file is big how can I upload it to your workspace ?

0 Votes 0 ·

Hi,
Due to the security and rules, we don't provide log analyze.
You may tryt to fox the content when the time changed (confirm the time from the event)
If you find anything, welcome to share here!
Best Regards,

0 Votes 0 ·
JackChuong-8462 avatar image
0 Votes"
JackChuong-8462 answered JackChuong-8462 published

Hi,
There is new log
It happened from 2:33 AM (jump forward to 9:22 AM) --> 3:16 AM (jump back from 10:03 AM) today so this is log when it turned righ -> wrong (19:34 in log)

 153534 19:30:01.9695922s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:40
 153534 19:30:07.0009546s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:43
 153534 19:30:12.0478985s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:44
 153534 19:30:15.4343721s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 19:30:15.4344175s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 19:30:15.4344832s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 19:30:16.0792297s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
 153534 19:30:21.1105591s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:35
 153534 19:30:26.1263576s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:37
 153534 19:30:31.1731892s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:40
 153534 19:30:36.1889662s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
 153534 19:30:41.2358955s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:44
 153534 19:30:46.2829197s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:46
 153534 19:30:50.3141678s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:34
 153534 19:30:55.3455876s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:35
 153534 19:31:00.3926024s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
 153534 19:31:05.4237769s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:41
 153534 19:31:10.4551845s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:43
 153534 19:31:15.5020870s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:45
 153534 19:31:19.5333725s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
 153534 19:31:22.4339469s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 19:31:22.4339836s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 19:31:22.4340445s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 19:31:24.5334848s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:35
 153534 19:31:29.5648183s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
 153534 19:31:34.5961559s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
 153534 19:31:39.6275402s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:42
 153534 19:31:44.6588495s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
 153534 19:31:49.7057769s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
 153534 19:31:53.7527557s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
 153534 19:31:58.8153712s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153534 19:32:03.8622554s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
 153534 19:32:08.9092804s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:40
 153534 19:32:13.9405863s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
 153534 19:32:18.9874972s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
 153534 19:32:23.0188411s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
 153534 19:32:28.0657806s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153534 19:32:28.4335782s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 19:32:28.4336214s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 19:32:28.4336830s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 19:32:33.0971188s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
 153534 19:32:38.1128218s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:40
 153534 19:32:43.1441547s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
 153534 19:32:48.1911368s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:44
 153534 19:32:52.2224241s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
 153534 19:32:54.6140845s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 19:32:54.6141277s - ListeningThread -- response heard from 192.168.27.104:123 <- 192.168.7.103:123
 153534 19:32:54.6141529s - Computing server signature: OLD:FALSE, RID:00001582, format:0x1
 153534 19:32:54.6147525s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.27.104:123
 153534 19:32:57.2693821s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:34
 153534 19:33:02.2851582s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
 153534 19:33:07.3321823s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
 153534 19:33:12.3478540s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:41
 153534 19:33:17.3947175s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
 153534 19:33:22.4416743s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:45
 153534 19:33:26.4887286s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
 153534 19:33:31.5199384s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:36
 153534 19:33:32.4332459s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 19:33:32.4333159s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 19:33:32.4334329s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 19:33:36.5513208s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
 153534 19:33:41.5982588s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
 153534 19:33:46.6453317s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:42
 153534 19:33:51.6765500s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
 153534 19:33:56.7235209s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:45
 153534 19:34:00.7391633s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
 153534 19:34:05.7861493s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153534 19:34:10.8174853s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
 153534 19:34:15.8488443s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:41
 153534 19:34:20.8801371s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:43
 153534 19:34:25.8802490s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
 153534 19:34:29.8962673s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
 153535 02:22:11.9873236s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:71 KPhO:37
 153535 02:22:12.6179811s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:22:12.6180237s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153535 02:22:12.6181494s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153535 02:22:17.1279778s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:37
 153535 02:22:20.8929072s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:22:20.8929458s - ListeningThread -- response heard from 192.168.14.38:123 <- 192.168.7.103:123
 153535 02:22:20.8929666s - Computing server signature: OLD:FALSE, RID:00001586, format:0x1
 153535 02:22:20.8934826s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.14.38:123
 153535 02:22:22.2533067s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:40
 153535 02:22:27.3156594s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:41
 153535 02:22:32.3781884s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
 153535 02:22:35.4677652s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:22:35.4678218s - ListeningThread -- response heard from 192.168.14.38:123 <- 192.168.7.103:123
 153535 02:22:35.4678529s - Computing server signature: OLD:FALSE, RID:00001586, format:0x1
 153535 02:22:35.4685881s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.14.38:123
 153535 02:22:37.5032427s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:44
 153535 02:22:41.5600051s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:66 KPhO:34
 153535 02:22:46.6284237s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
 153535 02:22:51.6754080s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:39
 153535 02:22:56.7536107s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:41
 153535 02:23:01.8161771s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:43
 153535 02:23:05.8318427s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:33
 153535 02:23:10.8632873s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
 153535 02:23:15.9101986s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153535 02:23:19.6176036s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:23:19.6176667s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153535 02:23:19.6177535s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153535 02:23:20.9415032s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
 153535 02:23:25.9728458s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:41
 153535 02:23:31.0041704s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
 153535 02:23:31.6591439s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:23:31.6591937s - ListeningThread -- response heard from 192.168.16.246:123 <- 192.168.7.103:123
 153535 02:23:31.6592267s - Computing server signature: OLD:FALSE, RID:0000158E, format:0x1
 153535 02:23:31.6603009s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.16.246:123
 153535 02:23:36.0354748s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:44
 153535 02:23:40.0512220s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:33
 153535 02:23:45.0981556s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:34
 153535 02:23:46.2487037s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:23:46.2487432s - ListeningThread -- response heard from 192.168.16.246:123 <- 192.168.7.103:123
 153535 02:23:46.2487634s - Computing server signature: OLD:FALSE, RID:0000158E, format:0x1
 153535 02:23:46.2493429s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.16.246:123
 153535 02:23:47.7026771s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:23:47.7027486s - ListeningThread -- response heard from 192.168.16.246:123 <- 192.168.7.103:123
 153535 02:23:47.7027878s - Computing server signature: OLD:FALSE, RID:0000158E, format:0x1
 153535 02:23:47.7037445s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.16.246:123
 153535 02:23:48.9860625s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:23:48.9861095s - ListeningThread -- response heard from 192.168.7.5:123 <- 192.168.7.103:123
 153535 02:23:48.9861527s - Computing server signature: OLD:FALSE, RID:00001574, format:0x1
 153535 02:23:48.9867558s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.5:123
 153535 02:23:50.1294704s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:37
 153535 02:23:55.1608324s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
 153535 02:24:00.2077633s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:40
 153535 02:24:03.5678160s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:24:03.5678611s - ListeningThread -- response heard from 192.168.7.5:123 <- 192.168.7.103:123
 153535 02:24:03.5678813s - Computing server signature: OLD:FALSE, RID:00001574, format:0x1
 153535 02:24:03.5684097s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.5:123
 153535 02:24:05.0194377s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:24:05.0194881s - ListeningThread -- response heard from 192.168.7.5:123 <- 192.168.7.103:123
 153535 02:24:05.0195080s - Computing server signature: OLD:FALSE, RID:00001574, format:0x1
 153535 02:24:05.0200756s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.5:123
 153535 02:24:05.2234541s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
 153535 02:24:10.2548147s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
 153535 02:24:12.3410671s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:24:12.3411408s - ListeningThread -- response heard from 192.168.7.5:123 <- 192.168.7.103:123
 153535 02:24:12.3411803s - Computing server signature: OLD:FALSE, RID:00001574, format:0x1
 153535 02:24:12.3421348s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.5:123
 153535 02:24:14.2861103s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:34
 153535 02:24:19.3330904s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:36
 153535 02:24:24.3800565s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
 153535 02:24:26.6159697s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 02:24:26.6160204s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153535 02:24:26.6160916s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153535 02:24:29.4270057s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:41
 153535 02:24:34.4739545s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:44
 153535 02:24:39.4896794s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:45
 153535 02:24:43.5209700s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
 153535 02:24:48.5835718s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153535 02:24:53.5994412s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
 153535 02:24:58.6462374s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:40
 153535 02:25:03.6619475s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:42
 153535 02:25:08.6932740s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:44

when it turned wrong -> right (03:04 in log)

 153535 03:00:02.2719565s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:00:02.2720088s - ListeningThread -- response heard from 192.168.12.146:123 <- 192.168.7.103:123
 153535 03:00:02.2720362s - Computing server digest: OLD:FALSE, RID:00000C98
 153535 03:00:02.2726181s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.12.146:123
 153535 03:00:05.2910943s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
 153535 03:00:13.3380411s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:33
 153535 03:00:22.4007088s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:37
 153535 03:00:23.3096411s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:00:23.3097064s - ListeningThread -- response heard from 192.168.6.30:123 <- 192.168.7.103:123
 153535 03:00:23.3097291s - Computing server signature: OLD:FALSE, RID:000015BD, format:0x1
 153535 03:00:23.3104096s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.6.30:123
 153535 03:00:27.6039932s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:00:27.6040342s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153535 03:00:27.6040946s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153535 03:00:30.4476735s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:33
 153535 03:00:35.6467961s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:00:35.6468509s - ListeningThread -- response heard from 192.168.6.184:123 <- 192.168.7.103:123
 153535 03:00:35.6468720s - Computing server signature: OLD:FALSE, RID:00002B0C, format:0x1
 153535 03:00:35.6475718s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.6.184:123
 153535 03:00:39.5416132s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
 153535 03:00:43.8532369s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:00:43.8532758s - ListeningThread -- response heard from 192.168.6.224:123 <- 192.168.7.103:123
 153535 03:00:43.8533026s - Computing server signature: OLD:FALSE, RID:00002AF4, format:0x1
 153535 03:00:43.8538826s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.6.224:123
 153535 03:00:47.6042305s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
 153535 03:00:51.8100577s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:00:51.8101062s - ListeningThread -- response heard from 192.168.7.17:123 <- 192.168.7.103:123
 153535 03:00:51.8101273s - Computing server digest: OLD:FALSE, RID:00000CF1
 153535 03:00:51.8107565s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.17:123
 153535 03:00:52.1668074s - PeerPollingThread: WaitTimeout
 153535 03:00:52.1668740s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153535 03:00:52.1671791s - Peer poll: Max:64.0000000s Cur:00.0000000s
 153535 03:00:52.1672235s - PeerPollingThread: waiting 64.000s
 153535 03:00:52.1878996s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:00:52.1879628s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
 153535 03:00:52.1891085s - /-- NTP Packet:
 153535 03:00:52.1891163s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
 153535 03:00:52.1891275s - | Stratum: 1 - primary reference (syncd by radio clock)
 153535 03:00:52.1891356s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
 153535 03:00:52.1891518s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.0646s - 10.0245s
 153535 03:00:52.1891704s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
 153535 03:00:52.1891826s - | ReferenceTimestamp:   0xE447FE989F9B852C - 13265408280623466800ns - 153534 19:38:00.6234668s
 153535 03:00:52.1892015s - | OriginateTimestamp:   0xE44866642AB98343 - 13265434852166893200ns - 153535 03:00:52.1668932s
 153535 03:00:52.1892199s - | ReceiveTimestamp:     0xE44806DEFF9B5CE8 - 13265410398998464400ns - 153534 20:13:18.9984644s
 153535 03:00:52.1892395s - | TransmitTimestamp:    0xE44806DEFFC4D22C - 13265410398999097000ns - 153534 20:13:18.9990970s
 153535 03:00:52.1892606s - >-- Non-packet info:
 153535 03:00:52.1892703s - | DestinationTimestamp: 153535 03:00:52.1892783s - 0xE4486664301DFB93153535 03:00:52.1892864s -  - 13265434852187957500ns153535 03:00:52.1892951s -  - 153535 03:00:52.1879575s
 153535 03:00:52.1893060s - | RoundtripDelay: 20431700ns (0s)
 153535 03:00:52.1893210s - | LocalClockOffset: -24453178644600ns - 407:33.178644600s
 153535 03:00:52.1893412s - \--
 153535 03:00:52.1893894s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
 153535 03:00:52.1894180s - Peer poll: Max:64.0000000s Cur:63.9777353s
 153535 03:00:52.1894410s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: -24453.1786446s
 153535 03:00:52.1894681s - 5 Age:1 Ofs:-24453.1774126s COfs:-24453.1774157s Dly:+00.0205601s RDly:+00.0000000s Dsp:00.0007411s RDsp:10.0237732s Pnt:00.0029628s Dst:00.0205601s FDsp:00.0000115s Jitter:14.0825689s AgeTime:+64.0024913s
 153535 03:00:52.1895184s - 4 Age:0 Ofs:-24453.1786446s COfs:-24453.1786446s Dly:+00.0204317s RDly:+00.0000000s Dsp:00.0000004s RDsp:10.0245056s Pnt:00.0000000s Dst:00.0204317s FDsp:00.0000115s Jitter:14.1003773s AgeTime:+00.0015047s
 153535 03:00:52.1895660s - 3 Age:5 Ofs:-24453.1789675s COfs:-24453.1789683s Dly:+00.0203351s RDly:+00.0000000s Dsp:00.0044447s RDsp:10.0200653s Pnt:00.0177772s Dst:00.0203351s FDsp:00.0002892s Jitter:15.4392054s AgeTime:+384.0078404s
 153535 03:00:52.1896133s - 2 Age:2 Ofs:-24453.1782662s COfs:-24453.1782659s Dly:+00.0197671s RDly:+00.0000000s Dsp:00.0014818s RDsp:10.0230255s Pnt:00.0059256s Dst:00.0197671s FDsp:00.0004744s Jitter:16.5715279s AgeTime:+128.0040584s
 153535 03:00:52.1896606s - 1 Age:4 Ofs:-24453.1800619s COfs:-24453.1800658s Dly:+00.0197049s RDly:+00.0000000s Dsp:00.0037040s RDsp:10.0208130s Pnt:00.0148144s Dst:00.0197049s FDsp:00.0014004s Jitter:37.9869235s AgeTime:+320.0073035s
 153535 03:00:52.1897119s - 0 Age:3 Ofs:-24453.1785989s COfs:-24453.1786024s Dly:+00.0186199s RDly:+00.0000000s Dsp:00.0029633s RDsp:10.0215454s Pnt:00.0118516s Dst:00.0186199s FDsp:00.0028820s Jitter:37.9869235s AgeTime:+256.0075042s
 153535 03:00:52.1897626s - Peer jitter: 00.0008716s Filter Dispersion: 00.0028820s
 153535 03:00:52.1898379s - W32TmServiceMain: resync req, irreg now pending.
 153535 03:00:52.1898830s - W32TmServiceMain: waiting i0.000s (144.634s)
 153535 03:00:52.1980672s - W32TmServiceMain: timeout
 153535 03:00:52.1980892s - Sample Prepared at 132654348521980849 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153535 03:00:52.1981079s - NtpClient returned 1 samples.
 153535 03:00:52.1981169s - Sample 0 offset:-24453.1786024s delay:+00.0186199s dispersion:24463.2039014s
 153535 03:00:52.1981322s - Intersection successful with 0 dropped samples.
 153535 03:00:52.1981418s -   0: Sample:0 SyncDist:244792132113 SelectDisp:0
 153535 03:00:52.1981502s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14480877
 153535 03:00:52.1981773s - ClockDispln Update: SO:-244531786020 KPhO:4 *PhO:-244531786024 uT:8193
  SD:9223372036854775808 (i) LI:0 S:2 RDl:186199 RDs:244632139014 TSF:0x8 Spike
 153535 03:00:52.1989318s - W32TmServiceMain: waiting 144.625s
 153535 03:00:56.2137323s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
 153535 03:01:01.0515837s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:01:01.0516260s - ListeningThread -- response heard from 192.168.6.33:123 <- 192.168.7.103:123
 153535 03:01:01.0516475s - Computing server signature: OLD:FALSE, RID:0000142A, format:0x1
 153535 03:01:01.0523028s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.6.33:123
 153535 03:01:05.2763630s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
 153535 03:01:08.8980856s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:01:08.8981690s - ListeningThread -- response heard from 192.168.16.247:123 <- 192.168.7.103:123
 153535 03:01:08.8981951s - Computing server signature: OLD:FALSE, RID:00001431, format:0x1
 153535 03:01:08.8988750s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.16.247:123
 153535 03:01:13.3077391s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:35
 153535 03:01:22.3547835s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
 153535 03:01:29.0101165s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:01:29.0101619s - ListeningThread -- response heard from 192.168.7.130:123 <- 192.168.7.103:123
 153535 03:01:29.0101828s - Computing server signature: OLD:FALSE, RID:00002ACC, format:0x1
 153535 03:01:29.0108430s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.130:123
 153535 03:01:30.3861960s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:35
 153535 03:01:32.6035393s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:01:32.6036074s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153535 03:01:32.6037321s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153535 03:01:39.4488093s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:39
 153535 03:01:47.5114478s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153535 03:01:56.1678031s - PeerPollingThread: WaitTimeout
 153535 03:01:56.1678482s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153535 03:01:56.1679527s - Peer poll: Max:64.0000000s Cur:00.0000000s
 153535 03:01:56.1679742s - PeerPollingThread: waiting 64.000s
 153535 03:01:56.1759604s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:01:56.1760198s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
 153535 03:01:56.1772990s - /-- NTP Packet:
 153535 03:01:56.1773074s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
 153535 03:01:56.1773186s - | Stratum: 1 - primary reference (syncd by radio clock)
 153535 03:01:56.1773266s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
 153535 03:01:56.1773434s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.0677s - 10.0253s
 153535 03:01:56.1773621s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
 153535 03:01:56.1773739s - | ReferenceTimestamp:   0xE447FE98A201B790 - 13265408280632838700ns - 153534 19:38:00.6328387s
 153535 03:01:56.1773929s - | OriginateTimestamp:   0xE44866A42AF92E54 - 13265434916167864700ns - 153535 03:01:56.1678647s
 153535 03:01:56.1774116s - | ReceiveTimestamp:     0xE448071EFE2A7CAB - 13265410462992835800ns - 153534 20:14:22.9928358s
 153535 03:01:56.1774315s - | TransmitTimestamp:    0xE448071EFE52DD1C - 13265410462993451900ns - 153534 20:14:22.9934519s
 153535 03:01:56.1774529s - >-- Non-packet info:
 153535 03:01:56.1774626s - | DestinationTimestamp: 153535 03:01:56.1774710s - 0xE44866A42D0F4949153535 03:01:56.1774790s -  - 13265434916176014500ns153535 03:01:56.1774874s -  - 153535 03:01:56.1760145s
 153535 03:01:56.1774986s - | RoundtripDelay: 7533700ns (0s)
 153535 03:01:56.1775136s - | LocalClockOffset: -24453178795700ns - 407:33.178795700s
 153535 03:01:56.1775341s - \--
 153535 03:01:56.1775792s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
 153535 03:01:56.1776006s - Peer poll: Max:64.0000000s Cur:63.9903328s
 153535 03:01:56.1776227s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: -24453.1787957s
 153535 03:01:56.1776495s - 5 Age:2 Ofs:-24453.1774126s COfs:-24453.1774125s Dly:+00.0205601s RDly:+00.0000000s Dsp:00.0014817s RDsp:10.0237732s Pnt:00.0059252s Dst:00.0205601s FDsp:00.0000231s Jitter:19.1324224s AgeTime:+127.9906730s
 153535 03:01:56.1777002s - 4 Age:1 Ofs:-24453.1786446s COfs:-24453.1786414s Dly:+00.0204317s RDly:+00.0000000s Dsp:00.0007410s RDsp:10.0245056s Pnt:00.0029624s Dst:00.0204317s FDsp:00.0000462s Jitter:19.3705073s AgeTime:+63.9896864s
 153535 03:01:56.1777546s - 3 Age:3 Ofs:-24453.1782662s COfs:-24453.1782627s Dly:+00.0197671s RDly:+00.0000000s Dsp:00.0022224s RDsp:10.0230255s Pnt:00.0088880s Dst:00.0197671s FDsp:00.0001851s Jitter:22.2113973s AgeTime:+191.9922401s
 153535 03:01:56.1778062s - 2 Age:5 Ofs:-24453.1800619s COfs:-24453.1800626s Dly:+00.0197049s RDly:+00.0000000s Dsp:00.0044446s RDsp:10.0208130s Pnt:00.0177768s Dst:00.0197049s FDsp:00.0007406s Jitter:38.2617534s AgeTime:+383.9954852s
 153535 03:01:56.1778551s - 1 Age:4 Ofs:-24453.1785989s COfs:-24453.1785992s Dly:+00.0186199s RDly:+00.0000000s Dsp:00.0037039s RDsp:10.0215454s Pnt:00.0148140s Dst:00.0186199s FDsp:00.0016665s Jitter:38.6478759s AgeTime:+319.9956859s
 153535 03:01:56.1779030s - 0 Age:0 Ofs:-24453.1787957s COfs:-24453.1787957s Dly:+00.0075337s RDly:+00.0000000s Dsp:00.0000002s RDsp:10.0252533s Pnt:00.0000000s Dst:00.0075337s FDsp:00.0016666s Jitter:38.6478759s AgeTime:+00.0016294s
 153535 03:01:56.1779508s - Peer jitter: 00.0008791s Filter Dispersion: 00.0016666s
 153535 03:01:56.1780071s - W32TmServiceMain: resync req, irreg now pending.
 153535 03:01:56.1780818s - W32TmServiceMain: waiting i0.000s (80.646s)
 153535 03:01:56.1833989s - W32TmServiceMain: timeout
 153535 03:01:56.1834181s - Sample Prepared at 132654349161834141 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153535 03:01:56.1834346s - NtpClient returned 1 samples.
 153535 03:01:56.1834433s - Sample 0 offset:-24453.1787957s delay:+00.0075337s dispersion:24463.2065947s
 153535 03:01:56.1834576s - Intersection successful with 0 dropped samples.
 153535 03:01:56.1834664s -   0: Sample:0 SyncDist:244792103615 SelectDisp:0
 153535 03:01:56.1834744s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14484972
 153535 03:01:56.1835015s - ClockDispln Update: SO:-244531787952 KPhO:37 *PhO:-244531787989 uT:4095
  SD:9223372036854775808 (i) LI:0 S:2 RDl:75337 RDs:244632165947 TSF:0x8 Spike
 153535 03:01:56.1841558s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:41 KPhO:37
 153535 03:01:56.1842131s - W32TmServiceMain: waiting 80.641s
 153535 03:02:04.2304372s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
 153535 03:02:13.3086975s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:38
 153535 03:02:21.3556996s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:34
 153535 03:02:27.5209714s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:02:27.5210152s - ListeningThread -- response heard from 192.168.27.154:123 <- 192.168.7.103:123
 153535 03:02:27.5210367s - Computing server signature: OLD:FALSE, RID:0000144E, format:0x1
 153535 03:02:27.5215993s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.27.154:123
 153535 03:02:30.4183732s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:39
 153535 03:02:37.6040909s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:02:37.6041279s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153535 03:02:37.6041870s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153535 03:02:38.4560541s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:02:38.4561095s - ListeningThread -- response heard from 192.168.27.83:123 <- 192.168.7.103:123
 153535 03:02:38.4561468s - Computing server signature: OLD:FALSE, RID:00002ADB, format:0x1
 153535 03:02:38.4568105s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.27.83:123
 153535 03:02:38.4809861s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153535 03:02:38.5678806s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:02:38.5679170s - ListeningThread -- response heard from 192.168.27.92:123 <- 192.168.7.103:123
 153535 03:02:38.5679438s - Computing server signature: OLD:FALSE, RID:000007C4, format:0x1
 153535 03:02:38.5685204s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.27.92:123
 153535 03:02:46.5436096s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33
 153535 03:02:55.6069622s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:36
 153535 03:03:00.1688061s - PeerPollingThread: WaitTimeout
 153535 03:03:00.1688540s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153535 03:03:00.1689280s - Peer poll: Max:64.0000000s Cur:00.0000000s
 153535 03:03:00.1689473s - PeerPollingThread: waiting 64.000s
 153535 03:03:00.1846643s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:03:00.1847010s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
 153535 03:03:00.1853912s - /-- NTP Packet:
 153535 03:03:00.1853952s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
 153535 03:03:00.1854008s - | Stratum: 1 - primary reference (syncd by radio clock)
 153535 03:03:00.1854046s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
 153535 03:03:00.1854129s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.06A7s - 10.026s
 153535 03:03:00.1854220s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
 153535 03:03:00.1854279s - | ReferenceTimestamp:   0xE447FE989F7CA71A - 13265408280622995800ns - 153534 19:38:00.6229958s
 153535 03:03:00.1854372s - | OriginateTimestamp:   0xE44866E42B3ABFEF - 13265434980168865200ns - 153535 03:03:00.1688652s
 153535 03:03:00.1854459s - | ReceiveTimestamp:     0xE448075EFF7C7ED6 - 13265410526997993400ns - 153534 20:15:26.9979934s
 153535 03:03:00.1854556s - | TransmitTimestamp:    0xE448075EFFB89AE6 - 13265410526998910600ns - 153534 20:15:26.9989106s
 153535 03:03:00.1854658s - >-- Non-packet info:
 153535 03:03:00.1854705s - | DestinationTimestamp: 153535 03:03:00.1854742s - 0xE44866E42F48684E153535 03:03:00.1854783s -  - 13265434980184698600ns153535 03:03:00.1854823s -  - 153535 03:03:00.1846986s
 153535 03:03:00.1854876s - | RoundtripDelay: 14916200ns (0s)
 153535 03:03:00.1854947s - | LocalClockOffset: -24453178329900ns - 407:33.178329900s
 153535 03:03:00.1855050s - \--
 153535 03:03:00.1855355s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
 153535 03:03:00.1855517s - Peer poll: Max:64.0000000s Cur:63.9833714s
 153535 03:03:00.1855632s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: -24453.1783299s
 153535 03:03:00.1855772s - 5 Age:3 Ofs:-24453.1774126s COfs:-24453.1774155s Dly:+00.0205601s RDly:+00.0000000s Dsp:00.0022225s RDsp:10.0237732s Pnt:00.0088884s Dst:00.0205601s FDsp:00.0000347s Jitter:19.1324224s AgeTime:+191.9986028s
 153535 03:03:00.1856017s - 4 Age:2 Ofs:-24453.1786446s COfs:-24453.1786444s Dly:+00.0204317s RDly:+00.0000000s Dsp:00.0014818s RDsp:10.0245056s Pnt:00.0059256s Dst:00.0204317s FDsp:00.0000810s Jitter:19.3705073s AgeTime:+127.9976162s
 153535 03:03:00.1856251s - 3 Age:4 Ofs:-24453.1782662s COfs:-24453.1782657s Dly:+00.0197671s RDly:+00.0000000s Dsp:00.0029632s RDsp:10.0230255s Pnt:00.0118512s Dst:00.0197671s FDsp:00.0002662s Jitter:22.2113973s AgeTime:+256.0001699s
 153535 03:03:00.1856481s - 2 Age:5 Ofs:-24453.1785989s COfs:-24453.1786022s Dly:+00.0186199s RDly:+00.0000000s Dsp:00.0044447s RDsp:10.0215454s Pnt:00.0177772s Dst:00.0186199s FDsp:00.0008217s Jitter:22.5975198s AgeTime:+384.0036157s
 153535 03:03:00.1856711s - 1 Age:0 Ofs:-24453.1783299s COfs:-24453.1783299s Dly:+00.0149162s RDly:+00.0000000s Dsp:00.0000003s RDsp:10.0259857s Pnt:00.0000000s Dst:00.0149162s FDsp:00.0008217s Jitter:24.7952542s AgeTime:+00.0008751s
 153535 03:03:00.1856938s - 0 Age:1 Ofs:-24453.1787957s COfs:-24453.1787987s Dly:+00.0075337s RDly:+00.0000000s Dsp:00.0007410s RDsp:10.0252533s Pnt:00.0029632s Dst:00.0075337s FDsp:00.0011922s Jitter:24.7952542s AgeTime:+64.0095592s
 153535 03:03:00.1857193s - Peer jitter: 00.0007042s Filter Dispersion: 00.0011922s
 153535 03:03:00.1857600s - W32TmServiceMain: resync req, irreg now pending.
 153535 03:03:00.1857827s - W32TmServiceMain: waiting i0.000s (16.639s)
 153535 03:03:00.2000096s - W32TmServiceMain: timeout
 153535 03:03:00.2000333s - Sample Prepared at 132654349802000273 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153535 03:03:00.2000612s - NtpClient returned 1 samples.
 153535 03:03:00.2000824s - Sample 0 offset:-24453.1787957s delay:+00.0075337s dispersion:24463.2065947s
 153535 03:03:00.2001060s - Intersection successful with 0 dropped samples.
 153535 03:03:00.2001222s -   0: Sample:0 SyncDist:244792103615 SelectDisp:0
 153535 03:03:00.2001331s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14484972
 153535 03:03:00.2001648s - ClockDispln Update: SO:-244531787983 KPhO:6 *PhO:-244531787989 uT:0
  SD:9223372036854775808 (i) LI:0 S:2 RDl:75337 RDs:244632165947 TSF:0x8 Spike->Unset
 153535 03:03:00.2007520s - Logging warning: The time service detected a time difference of greater than 5000 milliseconds for 900 seconds.  The system clock is unsynchronized.  This is usually caused by synchronizing from low-accuracy time sources, or by poor network conditions.
 153535 03:03:00.2007741s - W32TmServiceMain: waiting 64.000s
 153535 03:03:04.2157894s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153535 03:03:13.2628114s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
 153535 03:03:21.2941861s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153535 03:03:30.3568438s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
 153535 03:03:38.4038504s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:35
 153535 03:03:44.6036548s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:03:44.6037220s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153535 03:03:44.6038567s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153535 03:03:47.4508188s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:39
 153535 03:03:55.5291008s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:36
 153535 03:04:04.1698089s - PeerPollingThread: WaitTimeout
 153535 03:04:04.1698587s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153535 03:04:04.1699358s - Peer poll: Max:64.0000000s Cur:00.0000000s
 153535 03:04:04.1699554s - PeerPollingThread: waiting 64.000s
 153535 03:04:04.1887325s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153535 03:04:04.1887657s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
 153535 03:04:04.1894954s - /-- NTP Packet:
 153535 03:04:04.1894997s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
 153535 03:04:04.1895050s - | Stratum: 1 - primary reference (syncd by radio clock)
 153535 03:04:04.1895091s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
 153535 03:04:04.1895178s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.06D8s - 10.0267s
 153535 03:04:04.1895271s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
 153535 03:04:04.1895330s - | ReferenceTimestamp:   0xE447FE98A04CE307 - 13265408280626173200ns - 153534 19:38:00.6261732s
 153535 03:04:04.1895423s - | OriginateTimestamp:   0xE44867242B7C9D09 - 13265435044169870200ns - 153535 03:04:04.1698702s
 153535 03:04:04.1895510s - | ReceiveTimestamp:     0xE448079F004CB0B2 - 13265410591001170200ns - 153534 20:16:31.0011702s
 153535 03:04:04.1895610s - | TransmitTimestamp:    0xE448079F00841B83 - 13265410591002015800ns - 153534 20:16:31.0020158s
 153535 03:04:04.1895713s - >-- Non-packet info:
 153535 03:04:04.1895759s - | DestinationTimestamp: 153535 03:04:04.1895797s - 0xE44867243052CAA8153535 03:04:04.1895837s -  - 13265435044188763300ns153535 03:04:04.1895881s -  - 153535 03:04:04.1887633s
 153535 03:04:04.1895933s - | RoundtripDelay: 18047500ns (0s)
 153535 03:04:04.1896005s - | LocalClockOffset: -24453177723700ns - 407:33.177723700s
 153535 03:04:04.1896108s - \--
 153535 03:04:04.1896447s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
 153535 03:04:04.1896618s - Peer poll: Max:64.0000000s Cur:63.9802716s
 153535 03:04:04.1896736s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: -24453.1777237s
 153535 03:04:04.1896870s - 5 Age:4 Ofs:-24453.1774126s COfs:-24453.1774125s Dly:+00.0205601s RDly:+00.0000000s Dsp:00.0029632s RDsp:10.0237732s Pnt:00.0118512s Dst:00.0205601s FDsp:00.0000463s Jitter:19.1324224s AgeTime:+256.0027129s
 153535 03:04:04.1897118s - 4 Age:3 Ofs:-24453.1786446s COfs:-24453.1786414s Dly:+00.0204317s RDly:+00.0000000s Dsp:00.0022225s RDsp:10.0245056s Pnt:00.0088884s Dst:00.0204317s FDsp:00.0001157s Jitter:19.3705073s AgeTime:+192.0017263s
 153535 03:04:04.1897355s - 3 Age:5 Ofs:-24453.1782662s COfs:-24453.1782627s Dly:+00.0197671s RDly:+00.0000000s Dsp:00.0037039s RDsp:10.0230255s Pnt:00.0148140s Dst:00.0197671s FDsp:00.0003471s Jitter:22.2113973s AgeTime:+320.0042800s
 153535 03:04:04.1897591s - 2 Age:0 Ofs:-24453.1777237s COfs:-24453.1777237s Dly:+00.0180475s RDly:+00.0000000s Dsp:00.0000004s RDsp:10.0267334s Pnt:00.0000000s Dst:00.0180475s FDsp:00.0003471s Jitter:33.7032373s AgeTime:+00.0009205s
 153535 03:04:04.1897824s - 1 Age:1 Ofs:-24453.1783299s COfs:-24453.1783269s Dly:+00.0149162s RDly:+00.0000000s Dsp:00.0007410s RDsp:10.0259857s Pnt:00.0029628s Dst:00.0149162s FDsp:00.0005323s Jitter:35.9009717s AgeTime:+64.0049852s
 153535 03:04:04.1898058s - 0 Age:2 Ofs:-24453.1787957s COfs:-24453.1787957s Dly:+00.0075337s RDly:+00.0000000s Dsp:00.0014817s RDsp:10.0252533s Pnt:00.0059260s Dst:00.0075337s FDsp:00.0012731s Jitter:35.9009717s AgeTime:+128.0136693s
 153535 03:04:04.1898291s - Peer jitter: 00.0008473s Filter Dispersion: 00.0012731s
 153535 03:04:04.1898705s - W32TmServiceMain: resync req, reg too soon.
 153535 03:04:04.1899286s - W32TmServiceMain: waiting 0.010s
 153535 03:04:04.2010413s - W32TmServiceMain: timeout
 153535 03:04:04.2010613s - Sample Prepared at 132654350442010569 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153535 03:04:04.2010808s - NtpClient returned 1 samples.
 153535 03:04:04.2010896s - Sample 0 offset:-24453.1787957s delay:+00.0075337s dispersion:24463.2065947s
 153535 03:04:04.2011042s - Intersection successful with 0 dropped samples.
 153535 03:04:04.2011132s -   0: Sample:0 SyncDist:244792103615 SelectDisp:0
 153535 03:04:04.2011216s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14484972
 153535 03:04:04.2011486s - ClockDispln Update: SO:-244531787952 KPhO:37 *PhO:-244531787989 uT:0
  SD:9223372036854775808 LI:0 S:2 RDl:75337 RDs:244632165947 TSF:0x8 Unset->Hold
 153534 20:16:31.0224178s - ClockDispln Discipline: *SET*TIME* - KPho:-244531787952
 153534 20:16:31.0225136s - TimeProvCommand([NtpClient], TPC_TimeJumped) called.
 153534 20:16:31.0225400s - Peer poll: Max:64.0000000s Cur:63.9802716s153534 20:16:31.0225562s -  New:01.4999488s
 153534 20:16:31.0226383s - TimeProvCommand([NtpServer], TPC_TimeJumped) called.
 153534 20:16:31.0226517s - W32TmServiceMain: waiting 64.000s
 153534 20:16:31.0226215s - PeerPollingThread: PeerListUpdated
 153534 20:16:31.0227761s - PeerPollingThread: waiting 1.500s
 153534 20:16:31.0227662s - W32TmServiceMain: ********** Time Slip Notification **********
 153534 20:16:31.0228672s - PeerPollingThread: PeerListUpdated
 153534 20:16:31.0228909s - PeerPollingThread: waiting 1.500s
 153534 20:16:31.0228672s - ClockDispln TimeSlip: SetUnsync: LI:3 S:0 RDl:75337 RDs:244632165947 TSF:0x8 ReleaseClock2CMOS
 153534 20:16:31.0215017s - TimeProvCommand([NtpClient], TPC_TimeJumped) called.
 153534 20:16:31.0215250s - Peer poll: Max:64.0000000s Cur:01.4996001s
 153534 20:16:31.0215580s - TimeProvCommand([NtpServer], TPC_TimeJumped) called.
 153534 20:16:31.0216417s - PeerPollingThread: PeerListUpdated
 153534 20:16:31.0217070s - PeerPollingThread: waiting 1.500s
 153534 20:16:31.0216096s - W32TmServiceMain: waiting i16.000s (64.000s)
 153534 20:16:32.5198319s - PeerPollingThread: WaitTimeout
 153534 20:16:32.5198621s - PeerPollingThread: waiting 0.002s
 153534 20:16:32.5354469s - PeerPollingThread: WaitTimeout
 153534 20:16:32.5354777s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153534 20:16:32.5355533s - Peer poll: Max:64.0000000s Cur:00.0000000s
 153534 20:16:32.5355710s - PeerPollingThread: waiting 64.000s
 153534 20:16:32.5532002s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:16:32.5532578s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
 153534 20:16:32.5544999s - /-- NTP Packet:
 153534 20:16:32.5545077s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
 153534 20:16:32.5545192s - | Stratum: 1 - primary reference (syncd by radio clock)
 153534 20:16:32.5545273s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
 153534 20:16:32.5545463s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.06D9s - 10.0267s
 153534 20:16:32.5545730s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
 153534 20:16:32.5545855s - | ReferenceTimestamp:   0xE447FE98A030FB4A - 13265408280625747400ns - 153534 19:38:00.6257474s
 153534 20:16:32.5546078s - | OriginateTimestamp:   0xE44807A08915BDD7 - 13265410592535488000ns - 153534 20:16:32.5354880s
 153534 20:16:32.5546169s - | ReceiveTimestamp:     0xE44807A08C390280 - 13265410592547744900ns - 153534 20:16:32.5477449s
 153534 20:16:32.5546265s - | TransmitTimestamp:    0xE44807A08C6887A8 - 13265410592548470000ns - 153534 20:16:32.5484700s
 153534 20:16:32.5546368s - >-- Non-packet info:
 153534 20:16:32.5546414s - | DestinationTimestamp: 153534 20:16:32.5546455s - 0xE44807A08DA1F4B1153534 20:16:32.5546498s -  - 13265410592553252500ns153534 20:16:32.5546588s -  - 153534 20:16:32.5532525s
 153534 20:16:32.5546763s - | RoundtripDelay: 17039400ns (0s)
 153534 20:16:32.5546918s - | LocalClockOffset: 3737200ns - 0:00.003737200s
 153534 20:16:32.5547117s - \--
 153534 20:16:32.5547714s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
 153534 20:16:32.5548128s - Peer poll: Max:64.0000000s Cur:63.9807287s
 153534 20:16:32.5548246s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: +00.0037372s
 153534 20:16:32.5548383s - 5 Age:5 Ofs:+00.0000000s COfs:+48906.3035095s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0000177s RDsp:00.0000000s Pnt:00.0089592s Dst:16.0000000s FDsp:00.2500002s Jitter:00.0000000s AgeTime:-24259.6331223s
 153534 20:16:32.5548818s - 4 Age:4 Ofs:+00.0000000s COfs:+48906.3035095s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0000177s RDsp:00.0000000s Pnt:00.0059968s Dst:16.0000000s FDsp:00.7500007s Jitter:00.0000000s AgeTime:-24323.6211793s
 153534 20:16:32.5549341s - 3 Age:3 Ofs:+00.0000000s COfs:+48906.3035095s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0000177s RDsp:00.0000000s Pnt:00.0030336s Dst:16.0000000s FDsp:01.7500018s Jitter:00.0000000s AgeTime:-24387.6298634s
 153534 20:16:32.5549969s - 2 Age:2 Ofs:+00.0000000s COfs:+48906.3035095s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0000177s RDsp:00.0000000s Pnt:00.0000708s Dst:16.0000000s FDsp:03.7500040s Jitter:00.0000000s AgeTime:-24451.6339281s
 153534 20:16:32.5550202s - 1 Age:1 Ofs:+00.0000000s COfs:+48906.3035095s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0000177s RDsp:00.0000000s Pnt:00.0148848s Dst:16.0000000s FDsp:07.7500084s Jitter:00.0000000s AgeTime:-24131.6305686s
 153534 20:16:32.5550604s - 0 Age:0 Ofs:+00.0037372s COfs:+00.0037372s Dly:+00.0170394s RDly:+00.0000000s Dsp:00.0000004s RDsp:10.0267487s Pnt:00.0000000s Dst:00.0170394s FDsp:07.7500086s Jitter:00.0000000s AgeTime:+00.0015827s
 153534 20:16:32.5551095s - Peer jitter: 00.0000000s Filter Dispersion: 07.7500086s
 153534 20:16:32.5551820s - W32TmServiceMain: resync req, irreg already pending.
 153534 20:16:32.5552277s - W32TmServiceMain: waiting i14.466s (62.466s)
 153534 20:16:47.0198284s - W32TmServiceMain: timeout
 153534 20:16:47.0198872s - Sample Prepared at 132654106070198785 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153534 20:16:47.0199214s - NtpClient returned 1 samples.
 153534 20:16:47.0199373s - Sample 0 offset:+00.0037372s delay:+00.0170394s dispersion:17.7806619s
 153534 20:16:47.0199541s - Intersection successful with 0 dropped samples.
 153534 20:16:47.0199637s -   0: Sample:0 SyncDist:337891816 SelectDisp:0
 153534 20:16:47.0199724s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14494189
 153534 20:16:47.0200073s - ClockDispln Update: SO:37492 KPhO:120 PhO:37372 uT:1024
  SD:9223372036854775808 LI:0 S:2 RDl:170394 RDs:177906619 TSF:0x8 Unset->Hold
 153534 20:16:47.0206196s - W32TmServiceMain: waiting 64.000s
 153534 20:16:48.0200243s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:5 CR:156252 UI:100 phcT:64 KPhO:37500
 153534 20:16:54.0827071s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:4 CR:156252 UI:100 phcT:64 KPhO:35606
 153534 20:17:18.4225695s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:17:18.4226618s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 20:17:18.4227844s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 20:17:22.2875079s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:3 CR:156252 UI:100 phcT:65 KPhO:28599
 153534 20:17:36.5374061s - PeerPollingThread: WaitTimeout
 153534 20:17:36.5374555s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153534 20:17:36.5375809s - Peer poll: Max:64.0000000s Cur:00.0000000s
 153534 20:17:36.5376029s - PeerPollingThread: waiting 64.000s
 153534 20:17:36.5522706s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:17:36.5523169s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
 153534 20:17:36.5530686s - /-- NTP Packet:
 153534 20:17:36.5530730s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
 153534 20:17:36.5530783s - | Stratum: 1 - primary reference (syncd by radio clock)
 153534 20:17:36.5530823s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
 153534 20:17:36.5530910s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.070As - 10.0275s
 153534 20:17:36.5531000s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
 153534 20:17:36.5531056s - | ReferenceTimestamp:   0xE447FE989FC4BE0A - 13265408280624095800ns - 153534 19:38:00.6240958s
 153534 20:17:36.5531150s - | OriginateTimestamp:   0xE44807E0899774FC - 13265410656537467300ns - 153534 20:17:36.5374673s
 153534 20:17:36.5531249s - | ReceiveTimestamp:     0xE44807E08BCCBE8A - 13265410656546092900ns - 153534 20:17:36.5460929s
 153534 20:17:36.5531364s - | TransmitTimestamp:    0xE44807E08C1B93DA - 13265410656547295800ns - 153534 20:17:36.5472958s
 153534 20:17:36.5531467s - >-- Non-packet info:
 153534 20:17:36.5531517s - | DestinationTimestamp: 153534 20:17:36.5531554s - 0xE44807E08D646AE3153534 20:17:36.5531594s -  - 13265410656552313500ns153534 20:17:36.5531638s -  - 153534 20:17:36.5523135s
 153534 20:17:36.5531691s - | RoundtripDelay: 13643300ns (0s)
 153534 20:17:36.5531781s - | LocalClockOffset: 1803900ns - 0:00.001803900s
 153534 20:17:36.5531905s - \--
 153534 20:17:36.5532154s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
 153534 20:17:36.5532260s - Peer poll: Max:64.0000000s Cur:63.9843331s
 153534 20:17:36.5532372s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: +00.0018039s
 153534 20:17:36.5532509s - 5 Age:5 Ofs:+00.0000000s COfs:+48906.3023734s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0007584s RDsp:00.0000000s Pnt:00.0089596s Dst:16.0000000s FDsp:00.2500118s Jitter:00.0000000s AgeTime:-24259.6227671s
 153534 20:17:36.5532832s - 4 Age:4 Ofs:+00.0000000s COfs:+48906.3023734s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0007584s RDsp:00.0000000s Pnt:00.0059964s Dst:16.0000000s FDsp:00.7500355s Jitter:00.0000000s AgeTime:-24323.6314512s
 153534 20:17:36.5533081s - 3 Age:3 Ofs:+00.0000000s COfs:+48906.3023734s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0007584s RDsp:00.0000000s Pnt:00.0030336s Dst:16.0000000s FDsp:01.7500829s Jitter:00.0000000s AgeTime:-24387.6355159s
 153534 20:17:36.5533361s - 2 Age:2 Ofs:+00.0000000s COfs:+48906.3023734s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0007584s RDsp:00.0000000s Pnt:00.0178476s Dst:16.0000000s FDsp:03.7501777s Jitter:00.0000000s AgeTime:-24067.6321564s
 153534 20:17:36.5533591s - 1 Age:1 Ofs:+00.0037372s COfs:+00.0026011s Dly:+00.0170394s RDly:+00.0000000s Dsp:00.0007411s RDsp:10.0267487s Pnt:00.0029628s Dst:00.0170394s FDsp:03.7503629s Jitter:06.3552784s AgeTime:+63.9999949s
 153534 20:17:36.5533818s - 0 Age:0 Ofs:+00.0018039s COfs:+00.0018039s Dly:+00.0136433s RDly:+00.0000000s Dsp:00.0000003s RDsp:10.0274963s Pnt:00.0000000s Dst:00.0136433s FDsp:03.7503630s Jitter:06.3552784s AgeTime:+00.0009339s
 153534 20:17:36.5534045s - Peer jitter: 00.0007972s Filter Dispersion: 03.7503630s
 153534 20:17:36.5534369s - W32TmServiceMain: resync req, reg too soon.
 153534 20:17:36.5534543s - W32TmServiceMain: waiting 14.467s
 153534 20:17:51.0222866s - W32TmServiceMain: timeout
 153534 20:17:51.0223184s - Sample Prepared at 132654106710223134 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153534 20:17:51.0223389s - NtpClient returned 1 samples.
 153534 20:17:51.0223489s - Sample 0 offset:+00.0015435s delay:+00.0136433s dispersion:13.7803674s
 153534 20:17:51.0223653s - Intersection successful with 0 dropped samples.
 153534 20:17:51.0223747s -   0: Sample:0 SyncDist:297871890 SelectDisp:0
 153534 20:17:51.0223831s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14498285
 153534 20:17:51.0224117s - ClockDispln Update: SO:15326 KPhO:23299 PhO:-7973 uT:4096
 153534 20:17:51.0224434s -  sysPollTicks:4095.94 FllDown:65535.1 PllUp:4095.94 PllDown:32767.6 FllRA:-0.030415 PllRA:0.0584648
  RA:0 CR:156252 DecRA:0.146041 nT:0 RAPhO:0 SD:1348187098 LI:0 S:2 RDl:136433 RDs:137903674 TSF:0x8 Hold(0)
 153534 20:17:51.0230337s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:2 CR:156252 UI:100 phcT:38 KPhO:15326
 153534 20:17:51.0230658s - W32TmServiceMain: waiting 64.000s
 153534 20:18:00.1006895s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:14248
 153534 20:18:03.2460390s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:18:03.2460950s - ListeningThread -- response heard from 192.168.27.85:123 <- 192.168.7.103:123
 153534 20:18:03.2461171s - Computing server signature: OLD:FALSE, RID:0000143C, format:0x1
 153534 20:18:03.2467043s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.27.85:123
 153534 20:18:04.7486521s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:18:04.7486963s - ListeningThread -- response heard from 192.168.27.85:123 <- 192.168.7.103:123
 153534 20:18:04.7487174s - Computing server signature: OLD:FALSE, RID:0000143C, format:0x1
 153534 20:18:04.7492648s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.27.85:123
 153534 20:18:25.4229369s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:18:25.4229761s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 20:18:25.4230367s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 20:18:27.4229434s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:18:27.4229826s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 20:18:27.4230458s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 20:18:29.4229490s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:18:29.4229870s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 20:18:29.4230442s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 20:18:31.4229515s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:18:31.4229932s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 20:18:31.4230514s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 20:18:33.4229351s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:18:33.4229758s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 20:18:33.4230293s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 20:18:35.4229690s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:18:35.4230097s - ListeningThread -- response heard from 192.168.7.6:123 <- 192.168.7.103:123
 153534 20:18:35.4230682s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.6:123
 153534 20:18:40.5389719s - PeerPollingThread: WaitTimeout
 153534 20:18:40.5390092s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153534 20:18:40.5390745s - Peer poll: Max:64.0000000s Cur:00.0000000s
 153534 20:18:40.5390932s - PeerPollingThread: waiting 64.000s
 153534 20:18:40.5443994s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:18:40.5444271s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
 153534 20:18:40.5450662s - /-- NTP Packet:
 153534 20:18:40.5450706s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
 153534 20:18:40.5450762s - | Stratum: 1 - primary reference (syncd by radio clock)
 153534 20:18:40.5450799s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
 153534 20:18:40.5450886s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.073As - 10.0282s
 153534 20:18:40.5450979s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
 153534 20:18:40.5451038s - | ReferenceTimestamp:   0xE447FE989E9B5200 - 13265408280619557500ns - 153534 19:38:00.6195575s
 153534 20:18:40.5451129s - | OriginateTimestamp:   0xE448082089FD22D5 - 13265410720539018800ns - 153534 20:18:40.5390188s
 153534 20:18:40.5451222s - | ReceiveTimestamp:     0xE44808208AA34A1C - 13265410720541554100ns - 153534 20:18:40.5415541s
 153534 20:18:40.5451318s - | TransmitTimestamp:    0xE44808208ACC3420 - 13265410720542178400ns - 153534 20:18:40.5421784s
 153534 20:18:40.5451421s - >-- Non-packet info:
 153534 20:18:40.5451468s - | DestinationTimestamp: 153534 20:18:40.5451508s - 0xE44808208B5F6413153534 20:18:40.5451548s -  - 13265410720544424300ns153534 20:18:40.5451589s -  - 153534 20:18:40.5444243s
 153534 20:18:40.5451645s - | RoundtripDelay: 4781200ns (0s)
 153534 20:18:40.5451716s - | LocalClockOffset: 144700ns - 0:00.000144700s
 153534 20:18:40.5451816s - \--
 153534 20:18:40.5452049s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
 153534 20:18:40.5452195s - Peer poll: Max:64.0000000s Cur:63.9938528s
 153534 20:18:40.5452307s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: +00.0001447s
 153534 20:18:40.5452447s - 5 Age:5 Ofs:+00.0000000s COfs:+48906.3017743s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0014990s RDsp:00.0000000s Pnt:00.0089588s Dst:16.0000000s FDsp:00.2500234s Jitter:00.0000000s AgeTime:-24259.6394573s
 153534 20:18:40.5452690s - 4 Age:4 Ofs:+00.0000000s COfs:+48906.3017743s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0014990s RDsp:00.0000000s Pnt:00.0059960s Dst:16.0000000s FDsp:00.7500702s Jitter:00.0000000s AgeTime:-24323.6435220s
 153534 20:18:40.5452920s - 3 Age:3 Ofs:+00.0000000s COfs:+48906.3017743s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0014990s RDsp:00.0000000s Pnt:00.0208100s Dst:16.0000000s FDsp:01.7501638s Jitter:00.0000000s AgeTime:-24003.6401625s
 153534 20:18:40.5453150s - 2 Age:2 Ofs:+00.0037372s COfs:+00.0020020s Dly:+00.0170394s RDly:+00.0000000s Dsp:00.0014817s RDsp:10.0267487s Pnt:00.0059252s Dst:00.0170394s FDsp:01.7503490s Jitter:34.4956329s AgeTime:+127.9919888s
 153534 20:18:40.5453399s - 1 Age:1 Ofs:+00.0018039s COfs:+00.0012048s Dly:+00.0136433s RDly:+00.0000000s Dsp:00.0007409s RDsp:10.0274963s Pnt:00.0029624s Dst:00.0136433s FDsp:01.7505342s Jitter:45.7337530s AgeTime:+63.9929278s
 153534 20:18:40.5453645s - 0 Age:0 Ofs:+00.0001447s COfs:+00.0001447s Dly:+00.0047812s RDly:+00.0000000s Dsp:00.0000002s RDsp:10.0282288s Pnt:00.0000000s Dst:00.0047812s FDsp:01.7505343s Jitter:45.7337530s AgeTime:+00.0008170s
 153534 20:18:40.5453875s - Peer jitter: 00.0015121s Filter Dispersion: 01.7505343s
 153534 20:18:40.5454180s - W32TmServiceMain: resync req, reg too soon.
 153534 20:18:40.5454634s - W32TmServiceMain: waiting 14.477s
 153534 20:18:55.0237201s - W32TmServiceMain: timeout
 153534 20:18:55.0237564s - Sample Prepared at 132654107350237484 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153534 20:18:55.0237851s - NtpClient returned 1 samples.
 153534 20:18:55.0237963s - Sample 0 offset:+00.0000677s delay:+00.0047812s dispersion:11.7805104s
 153534 20:18:55.0238115s - Intersection successful with 0 dropped samples.
 153534 20:18:55.0238208s -   0: Sample:0 SyncDist:277829010 SelectDisp:0
 153534 20:18:55.0238289s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14502381
 153534 20:18:55.0238572s - ClockDispln Update: SO:647 KPhO:11247 PhO:-10600 uT:4096
 153534 20:18:55.0238861s -  sysPollTicks:4095.94 FllDown:65535.1 PllUp:4095.94 PllDown:32767.5 FllRA:-0.0404363 PllRA:0.00246814
  RA:0 CR:156252 DecRA:0.108073 nT:0 RAPhO:0 SD:958435896 LI:0 S:2 RDl:47812 RDs:117905104 TSF:0x8 Hold(1)
 153534 20:18:55.0244353s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:10 CR:156252 UI:100 phcT:35 KPhO:647
 153534 20:18:55.0245069s - W32TmServiceMain: waiting 64.000s
 153534 20:18:59.0550914s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:35
 153534 20:19:09.1177553s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:39
 153534 20:19:18.1647852s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
 153534 20:19:24.4675604s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:19:24.4676294s - ListeningThread -- response heard from 192.168.7.13:123 <- 192.168.7.103:123
 153534 20:19:24.4676686s - Computing server signature: OLD:FALSE, RID:000013F9, format:0x1
 153534 20:19:24.4687214s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.13:123
 153534 20:19:27.1962018s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:36
 153534 20:19:36.2119182s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:35
 153534 20:19:37.5364330s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:19:37.5365123s - ListeningThread -- response heard from 192.168.7.13:123 <- 192.168.7.103:123
 153534 20:19:37.5365527s - Computing server signature: OLD:FALSE, RID:000013F9, format:0x1
 153534 20:19:37.5376273s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.7.13:123
 153534 20:19:43.9921935s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:19:43.9922625s - ListeningThread -- response heard from 192.168.12.185:123 <- 192.168.7.103:123
 153534 20:19:43.9923027s - Computing server signature: OLD:FALSE, RID:000014AF, format:0x1
 153534 20:19:43.9932786s - TransmitResponse: sent 0.0.0.0:123(192.168.7.103:123)->192.168.12.185:123
 153534 20:19:44.5401736s - PeerPollingThread: WaitTimeout
 153534 20:19:44.5402131s - Polling peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153534 20:19:44.5402821s - Peer poll: Max:64.0000000s Cur:00.0000000s
 153534 20:19:44.5403213s - PeerPollingThread: waiting 64.000s
 153534 20:19:44.5444164s - ListeningThread -- DataAvailEvent set for socket 1 (0.0.0.0:123)
 153534 20:19:44.5444435s - ListeningThread -- response heard from 192.168.0.104:123 <- 192.168.7.103:123
 153534 20:19:44.5452530s - /-- NTP Packet:
 153534 20:19:44.5452574s - | LeapIndicator: 0 - no warning;  VersionNumber: 3;  Mode: 4 - Server;  LiVnMode: 0x1C
 153534 20:19:44.5452630s - | Stratum: 1 - primary reference (syncd by radio clock)
 153534 20:19:44.5452670s - | Poll Interval: 6 - 64s;  Precision: -23 - 119.209ns per tick
 153534 20:19:44.5452754s - | RootDelay: 0x0000.0000s - unspecified;  RootDispersion: 0x000A.076Bs - 10.029s
 153534 20:19:44.5452847s - | ReferenceClockIdentifier: 0x4C4F434C - source name: "LOCL"
 153534 20:19:44.5452907s - | ReferenceTimestamp:   0xE447FE989EBD29C1 - 13265408280620073900ns - 153534 19:38:00.6200739s
 153534 20:19:44.5452997s - | OriginateTimestamp:   0xE44808608A4C86C1 - 13265410784540230200ns - 153534 20:19:44.5402302s
 153534 20:19:44.5453087s - | ReceiveTimestamp:     0xE44808608AC530F7 - 13265410784542071400ns - 153534 20:19:44.5420714s
 153534 20:19:44.5453183s - | TransmitTimestamp:    0xE44808608B055D37 - 13265410784543050600ns - 153534 20:19:44.5430506s
 153534 20:19:44.5453283s - >-- Non-packet info:
 153534 20:19:44.5453329s - | DestinationTimestamp: 153534 20:19:44.5453370s - 0xE44808608B607C41153534 20:19:44.5453407s -  - 13265410784544441000ns153534 20:19:44.5453451s -  - 153534 20:19:44.5444410s
 153534 20:19:44.5453504s - | RoundtripDelay: 3231600ns (0s)
 153534 20:19:44.5453575s - | LocalClockOffset: 225400ns - 0:00.000225400s
 153534 20:19:44.5453672s - \--
 153534 20:19:44.5453917s - Response received from domain controller dc1.mydomain.com authenticated successfully (using signature format)
 153534 20:19:44.5454023s - Peer poll: Max:64.0000000s Cur:63.9948760s
 153534 20:19:44.5454138s - Response from peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123), ofs: +00.0002254s
 153534 20:19:44.5454272s - 5 Age:5 Ofs:+00.0000000s COfs:+48906.3016322s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0022397s RDsp:00.0000000s Pnt:00.0089588s Dst:16.0000000s FDsp:00.2500349s Jitter:00.0000000s AgeTime:-24259.6433392s
 153534 20:19:44.5454511s - 4 Age:4 Ofs:+00.0000000s COfs:+48906.3016322s Dly:+00.0000000s RDly:+00.0000000s Dsp:16.0022397s RDsp:00.0000000s Pnt:00.0237728s Dst:16.0000000s FDsp:00.7501048s Jitter:00.0000000s AgeTime:-23939.6399797s
 153534 20:19:44.5454769s - 3 Age:3 Ofs:+00.0037372s COfs:+00.0018599s Dly:+00.0170394s RDly:+00.0000000s Dsp:00.0022224s RDsp:10.0267487s Pnt:00.0088880s Dst:00.0170394s FDsp:00.7502437s Jitter:26.7159025s AgeTime:+191.9921716s
 153534 20:19:44.5455015s - 2 Age:2 Ofs:+00.0018039s COfs:+00.0010627s Dly:+00.0136433s RDly:+00.0000000s Dsp:00.0014816s RDsp:10.0274963s Pnt:00.0059252s Dst:00.0136433s FDsp:00.7504289s Jitter:33.7266154s AgeTime:+127.9931106s
 153534 20:19:44.5455242s - 1 Age:1 Ofs:+00.0001447s COfs:+00.0000026s Dly:+00.0047812s RDly:+00.0000000s Dsp:00.0007409s RDsp:10.0282288s Pnt:00.0029628s Dst:00.0047812s FDsp:00.7506141s Jitter:34.2230138s AgeTime:+64.0009998s
 153534 20:19:44.5455469s - 0 Age:0 Ofs:+00.0002254s COfs:+00.0002254s Dly:+00.0032316s RDly:+00.0000000s Dsp:00.0000002s RDsp:10.0289764s Pnt:00.0000000s Dst:00.0032316s FDsp:00.7506142s Jitter:34.2230138s AgeTime:+00.0009831s
 153534 20:19:44.5455693s - Peer jitter: 00.0010680s Filter Dispersion: 00.7506142s
 153534 20:19:44.5456048s - W32TmServiceMain: resync req, reg too soon.
 153534 20:19:44.5456502s - W32TmServiceMain: waiting 14.478s
 153534 20:19:45.2589351s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:33
 153534 20:19:55.3216398s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:64 KPhO:38
 153534 20:19:59.0248182s - W32TmServiceMain: timeout
 153534 20:19:59.0335545s - Sample Prepared at 132654107990335430 for peer dc1.mydomain.com (ntp.d|0.0.0.0:123->192.168.0.104:123)
 153534 20:19:59.0335940s - NtpClient returned 1 samples.
 153534 20:19:59.0336102s - Sample 0 offset:+00.0002222s delay:+00.0032316s dispersion:10.7810484s
 153534 20:19:59.0336339s - Intersection successful with 0 dropped samples.
 153534 20:19:59.0336513s -   0: Sample:0 SyncDist:267826642 SelectDisp:0
 153534 20:19:59.0336659s - Sample 0 chosen. Select Dispersion:00.0000000s STC:14506477
 153534 20:19:59.0337091s - ClockDispln Update: SO:2226 KPhO:-2 PhO:2228 uT:4096
 153534 20:19:59.0337393s -  sysPollTicks:4095.94 FllDown:65535.1 PllUp:4095.94 PllDown:32767.6 FllRA:0.00849926 PllRA:0.00849163
  RA:0 CR:156252 DecRA:0.125064 nT:0 RAPhO:0 SD:137936751 Poll++ LI:0 S:2 RDl:32316 RDs:107910484 TSF:0x8 Hold(2)
 153534 20:19:59.0343091s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:34 CR:156252 UI:100 phcT:43 KPhO:2226
 153534 20:19:59.0343414s - TimeProvCommand([NtpClient], TPC_PollIntervalChanged) called.
 153534 20:19:59.0343595s - Peer poll: Max:64.0000000s Cur:49.5059195s
 153534 20:19:59.0343781s - TimeProvCommand([NtpServer], TPC_PollIntervalChanged) called.
 153534 20:19:59.0343896s - W32TmServiceMain: waiting 128.000s
 153534 20:19:59.0343903s - PeerPollingThread: PeerListUpdated
 153534 20:19:59.0344080s - PeerPollingThread: waiting 49.506s
 153534 20:20:01.0563683s - ClockDispln Discipline: *SKEW*TIME* - PhCRR:1 CR:156252 UI:100 phcT:65 KPhO:33


· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi,
Would you please confirm what are the IP addressed used for?
192.168.7.103?
192.168.7.104(dc1)
192.168.7.6?
192.168.7.5?
192.168.14.38?
192.168.16.246?
Fan

0 Votes 0 ·

Hi,
192.168.7.103 - my dc-south
192.168.0.104 - my PDC dc1 (not 7.104)
192.168.7.6 - a NAS device at south site
192.168.14.38 , 192.168.16.246 - workstations at south site.

0 Votes 0 ·
FanFan-MSFT avatar image
0 Votes"
FanFan-MSFT answered FanFan-MSFT commented

Hi,

You south-DC may tried to sync time with itself when the PDC is unavailable.
Not sure if it was caused you use the NTP to sync time.
It is suggested to use the NT5DS to sync time instead of NTP for alI the workstations and DCs except the ROOT PDC in the domain.
Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type
Key Name: Type
Type: REG_SZ(String Value)
Data: NT5DS

Best Regards,


· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I have checked registry, my dc-south and all DCs and workstation used NT5DS to sync time at the beginning.
I rebooted and updated Windows several days ago when I found problem, so if debug log does not give any useful information about what was causing the problem , it may be some mystery hardware problem ?

0 Votes 0 ·

You can consider resetting the type to NT5DS.
And run command on the South-DC:
net stop w32time
w32tm /unregister
w32tm /register
net start w32time
Then to confirm the time source again
w32tm /query /configuration
w32tm /query /source

Best Regards,

1 Vote 1 ·
JackChuong-8462 avatar image
0 Votes"
JackChuong-8462 answered FanFan-MSFT commented

Hi,
I have checked
96647-7.png


 net stop w32time
 The Windows Time service is stopping.
 The Windows Time service was stopped successfully.
    
 w32tm /unregister
 W32Time successfully unregistered.
    
 w32tm /register
 W32Time successfully registered.
    
 net start w32time
 The Windows Time service is starting.
 The Windows Time service was started successfully.
    
 w32tm /query /configuration
 [Configuration]
    
 EventLogFlags: 2 (Local)
 AnnounceFlags: 10 (Local)
 TimeJumpAuditOffset: 28800 (Local)
 MinPollInterval: 6 (Local)
 MaxPollInterval: 10 (Local)
 MaxNegPhaseCorrection: 172800 (Local)
 MaxPosPhaseCorrection: 172800 (Local)
 MaxAllowedPhaseOffset: 300 (Local)
    
 FrequencyCorrectRate: 4 (Local)
 PollAdjustFactor: 5 (Local)
 LargePhaseOffset: 50000000 (Local)
 SpikeWatchPeriod: 900 (Local)
 LocalClockDispersion: 10 (Local)
 HoldPeriod: 5 (Local)
 PhaseCorrectRate: 7 (Local)
 UpdateInterval: 100 (Local)
    
    
 [TimeProviders]
    
 NtpClient (Local)
 DllName: C:\Windows\SYSTEM32\w32time.DLL (Local)
 Enabled: 1 (Local)
 InputProvider: 1 (Local)
 CrossSiteSyncFlags: 2 (Local)
 AllowNonstandardModeCombinations: 1 (Local)
 ResolvePeerBackoffMinutes: 15 (Local)
 ResolvePeerBackoffMaxTimes: 7 (Local)
 CompatibilityFlags: 2147483648 (Local)
 EventLogFlags: 1 (Local)
 LargeSampleSkew: 3 (Local)
 SpecialPollInterval: 3600 (Local)
 Type: NT5DS (Local)
    
 NtpServer (Local)
 DllName: C:\Windows\SYSTEM32\w32time.DLL (Local)
 Enabled: 1 (Local)
 InputProvider: 0 (Local)
 AllowNonstandardModeCombinations: 1 (Local)
    
 VMICTimeProvider (Local)
 DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
 Enabled: 1 (Local)
 InputProvider: 1 (Local)
    
    
 w32tm /query /source
 dc1.mydomain.com

I will wait and see


7.png (53.7 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Also from the Debug, it seems the time was not changed by WIN32.
You can try to find more clues from the security logs.
Best Regards,

1 Vote 1 ·
JackChuong-8462 avatar image
0 Votes"
JackChuong-8462 answered JackChuong-8462 published

Hi,
Here some information from the security logs
96664-8.png


Their contents are similar , I post some here

 The system time was changed.
    
 Subject:
  Security ID: LOCAL SERVICE
  Account Name: LOCAL SERVICE
  Account Domain: NT AUTHORITY
  Logon ID: 0x3E5
    
 Process Information:
  Process ID: 0x374
  Name: C:\Windows\System32\svchost.exe
    
 Previous Time: ‎2021‎-‎05‎-‎14T07:13:34.507904200Z
 New Time: ‎2021‎-‎05‎-‎14T07:13:34.497000000Z
    
 This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
    
 The system time was changed.
    
 Subject:
  Security ID: LOCAL SERVICE
  Account Name: LOCAL SERVICE
  Account Domain: NT AUTHORITY
  Logon ID: 0x3E5
    
 Process Information:
  Process ID: 0x374
  Name: C:\Windows\System32\svchost.exe
    
 Previous Time: ‎2021‎-‎05‎-‎13T20:16:31.022924500Z
 New Time: ‎2021‎-‎05‎-‎13T20:16:31.022000000Z
    
 This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.

But this one is interesting

 The system time was changed.
    
 Subject:
     Security ID:        SYSTEM
     Account Name:        dc-south$
     Account Domain:        mydomain
     Logon ID:        0x3E7
    
 Process Information:
     Process ID:    0xb04
     Name:        C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
    
 Previous Time:        ‎2021‎-‎05‎-‎13T19:34:33.864681100Z
 New Time:        ‎2021‎-‎05‎-‎14T02:22:10.831000000Z
    
 This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.

vmware tool is installed on dc-south long time ago, this time problem has appeared recently.
I will try this article https://kb.vmware.com/s/article/1189 and feedback later.


8.png (79.6 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.