re: Virtualisation, Time Sync & Domain Controllers

nickmac — Wed, 13 Aug 2008 03:46:20 GMT

Hi All,

Here are some things that need to be considered for customers running ESX 3.5U2 if the plan is to put the clock back and then moving it forward.

The effect of advancing the system clock on FRS replica members

If you advance the system time on a computer that is running, the following situations may occur:

1. Tombstones for deleted files in the IDTable are prematurely deleted, which causes incorrect reconciliation decisions later. If the deleted tombstone is gone, then a concurrent update, which arrives at this member, produces a different reconciliation result from other members. The end result is that the files and folders in the affected DFS or SYSVOL replica sets are inconsistent between members. FRS data reconciliation between two partners that were not subjected to the time advance occurs as expected. Data replication between a member that was time-advanced and a non-advanced member will not work as expected, if at all.

2. The computer with the advanced clock does not join with partners that remain at the correct time. The join protocol, which is used by DFS or SYSVOL replica members to exchange data, ensures that the time clock on the two partners is within a certain tolerance.

3. Local file changes create change orders with event times while using the advanced clock time. These change orders are inserted into the outbound log but are not sent because of the reason that is outlined in step 2. When you restore the time on this computer to normal time, the computer joins with its outbound partners. Change orders, with the advanced time, are sent to downstream partners and the downstream partners ignore these change orders because the event time is invalid (it is too far in the future).

As a result, files that you changed while the time was advanced are not replicated to the other members (but they do remain on the changed computer). In addition, because of the invalid (advanced) event times in the IDTable entry, this member rejects updates to these files that originate from other members.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;289668

Advancing time on production computers and the effect on Active Directory and FRS

http://support.microsoft.com/default.aspx?scid=kb;EN-US;888794

Considerations when hosting Active Directory domain controller in virtual hosting environments

Something else to think about is moving the Virtual machines to Hyper-V (http://www.microsoft.com/windowsserver2008/en/us/virtualization-consolidation.aspx) and utilising Virtual Machine Manager (http://www.microsoft.com/systemcenter/virtualmachinemanager/en/us/default.aspx) to convert these images - http://technet.microsoft.com/en-us/library/bb740931.aspx.

Nick.

Active Directory in Hyper-V environments, Part 1

The things that are better left unspoken — Wed, 13 Aug 2008 20:06:25 GMT

Virtualization offers huge benefits in flexibility, cost-effectiveness and eco-friendliness. However,