Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,530 questions
I see the log is filtered. What else is in there error-wise?
Nonstop Time-Service Event 35 and 37 - Server 2016 / HyperV Role
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(70.4, 0%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Rootaah
0
Reputation points
Fully updated Windows 2016 Standard / HyperV role installed. Hosted VMs are simple RDS servers and do not have Time Syncronization enabled. HV gets time from public site, VMs from local DC. Patched over the weekend and as of this morning, the SYSTEM event logs of the HV host are being constantly updated with informational EVENT IDs 35 and 37 Time-Service. I'm not seeing any related issues or problems, but this stood out as something very odd. It was not happening prior to patching this weekend (01/28/2022). Other similar servers that I have looked at are not flagging these information events like this in such a repeating fashion. I've even changed the time service to a different one, such as time.windows.com, etc...and same thing.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(249.60000000000002, 21%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPM%3C/text%3E%3C/svg%3E)
Parks, Michael J 0 Reputation points2024-11-08T20:30:15.9766667+00:00 Had the same problem, and was using Time.Windows.com for the NTP provider. I looked and saw that the IP for time.windows.com was changing, hence the event log entry. I changed the provider to my local domain controller and the spamming of the logs stopped.
Sign in to comment
5 answers
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2023-01-30T16:36:18.4866667+00:00 -
Anonymous
2023-01-31T13:30:27.3433333+00:00 Just checking if there's any progress or updates?
--please don't forget to
upvoteandAccept as answerif the reply is helpful-- -
Rootaah 0 Reputation points
2023-01-31T19:16:55.3166667+00:00 Very little, couple service control manager events. Nothing else alarming. Here's an example.
-
Rootaah 0 Reputation points
2023-01-31T19:19:00.8+00:00 Nothing out of the ordinary. Normal looking logs otherwise.
Sign in to comment -
-
Anonymous
2023-01-31T22:48:31.0833333+00:00 Might try resetting things.
w32tm /unregister net stop w32time w32tm /register net start w32time w32tm /config /manualpeerlist:<ntp ip address> /syncfromflags:manual /reliable:yes /update net stop w32time net start w32time #then check w32tm /query /source w32tm /query /configuration--please don't forget to
upvoteandAccept as answerif the reply is helpful---
Rootaah 0 Reputation points
2023-02-01T00:18:21.9033333+00:00 Thanks. Just ran that. Will keep you posted.
-
Rootaah 0 Reputation points
2023-02-01T00:22:44.3966667+00:00 Looks like it's still happening. No change. I highleted the entries that appeared during the re-registering. But then you can see it's starting right back up again. Also posted config results below.
Sign in to comment -
-
Anonymous
2023-02-01T01:46:42.6133333+00:00 What are the 7036's ? Does it happen to be the Windows Time service?
-
Rootaah 0 Reputation points
2023-02-01T04:33:13.48+00:00 Normal stuff. The Software Protection Service entered the stopped state, running state. WMI Performance Adapter service entered the stopped state. Windows Insider Service, Update Orchestrator Service, Etc., Etc.
-
Anonymous
2023-02-01T13:38:32.6266667+00:00 Then I'd suggest standing up a new one to test with. Not seeing this behavior here.
-
Rootaah 0 Reputation points
2023-02-02T16:56:03.21+00:00 Umm...do you mean installing a new server?
-
Anonymous
2023-02-02T19:19:17.5733333+00:00 Correct, stand up a new one for testing.
-
Anonymous
2023-02-03T13:50:25.7366667+00:00 Just checking if there's any progress or updates?
--please don't forget to
upvoteandAccept as answerif the reply is helpful-- -
Rootaah 0 Reputation points
2023-02-03T15:12:38.08+00:00 Installing a new server is simply not an option for this issue / problem. Something is causing the time service to repeatedly request a sync for new time. There has to be some other reason for this.
Sign in to comment -
-
Anonymous
2023-02-03T15:33:00.83+00:00 Well, yes, we know something is causing it. The problem is what. There has to be some trouble shooting steps in order to figure things out and standing up a new virtual machine should be a fairly simple process. But if you can't for some reason then you can't. A wild guess from here (nothing to base this on because of no trouble shooting steps) is that it is something network related, or possible ISP related, but we may never know. You could also start a case here with product support.
https://support.serviceshub.microsoft.com/supportforbusiness
--please don't forget to
upvoteandAccept as answerif the reply is helpful---
Rootaah 0 Reputation points
2023-02-03T20:17:00.28+00:00 This is a physical server. Not a VM. If it matters. We have numerous other physical hosts set in a similar manner for this client and none of the other servers exhibit this behavior. Probably going to have to open an official support request as you suggest.
Sign in to comment -
-
Anonymous
2023-02-03T20:21:09.3333333+00:00 Ok, that's good info. If it were me, I'd save the $500 support call and export / move the VMs off to removeable, clean install host, patch fully, add hyper-v role, import VMs, and move on.
--please don't forget to
upvoteandAccept as answerif the reply is helpful---
Deleted
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
-
Deleted
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
-
Anonymous
2023-02-06T13:48:57.61+00:00 Just checking if there's any progress or updates?
--please don't forget to
upvoteandAccept as answerif the reply is helpful-- -
Rootaah 0 Reputation points
2023-02-06T13:50:05.7133333+00:00 Nothing more. Letting it be for now since no other issues are being seen at the moment. As an MSP we do have some access to free Microsoft Support calls in limits, so we may just wait until that opens up for us. The client is a 24/7 shop and sees no reason to perform downtime to move the VMs to another host at this time. Thanks for your input regardless.
-
Anonymous
2023-02-07T14:10:58.7933333+00:00 Sounds good, please don't forget to close up the thread here by marking helpful answers.
-
Anonymous
2023-02-10T14:07:12.77+00:00 Just checking if there's any progress or updates?
--please don't forget to
upvoteandAccept as answerif the reply is helpful--
Sign in to comment -