question

FranciscoConceio-6199 avatar image
0 Votes"
FranciscoConceio-6199 asked JeffYang-MSFT commented

Exchange Server 2013 CU23 time desync

Hi Everyone,

I have a Win2012R2 with Exchange 2013 CU23 installed,


Last March I was one of the lucky guys who got the HAFNIUM exploit. After patching and cleaning everything ran smoothly.
The last 2 days my Exchange is down. I noticed the server clock goes ahead 16 min every minute. I´ve tried to manually update the clock and on each min thick the clock goes 16 min ahead.

So far I´ve:

  1. Installed every security patch I could find.

  2. Look for any ScheduleTask that could be set

  3. Stop IIS7 (maybe was something running on the Application Pool)

  4. Run Microsoft Safety Scanner

  5. Run Kaspersky offline scanner

and can´t get anywhere .....

My sixth sense tells me its Exhcange exploit of some kind (and my other servers SQL / DC are not affected) by I can't seen to find it.
I see an Event saying "Change Reason: An application or system component changed the time." but I can´t trace it to the source.

Any idea how can I trace this app or what might be changing the clock?

Many thanks

office-exchange-server-administration
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

JeffYang-MSFT avatar image
0 Votes"
JeffYang-MSFT answered JeffYang-MSFT commented

Hi @FranciscoConceio-6199,

Welcome to Microsoft Q&A!

I see an Event saying "Change Reason: An application or system component changed the time." but I can´t trace it to the source.

I tried much research about your time-desync issue but could not find any similar thread which shows Exchange might change that. May I know what specific operations did you do before this problem occurred? In order to further confirm your issue, I would suggest you to check if this event message appears regularly every once in a while. If yes, you could try taking a snapshot of the system at that point in time to see what is running to try to narrow it down to which application might be changing the time.

By the way, have you ever tried the re-register the w32tm service method like mentioned in this case? If not, that should worth a shot to see if it could help solve your issue.


If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @FranciscoConceio-6199,
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.

0 Votes 0 ·