We have 3 domain controllers. One of them is a VM and the date changed to 2 months ago on it. The VM does not hold any FSMO roles. The other 2 DC's aren't effected. Does anyone know why this happened. I can provide any more details that you request? w32tm /query /configuration (from vm where time changed) [Configuration] EventLogFlags: 2 (Local) AnnounceFlags: 10 (Local) TimeJumpAuditOffset: 28800 (Local) MinPollInterval: 6 (Local) MaxPollInterval: 10 (Local) MaxNegPhaseCorrection: 172800 (Local) MaxPosPhaseCorrection: 172800 (Local) MaxAllowedPhaseOffset: 300 (Local) FrequencyCorrectRate: 4 (Local) PollAdjustFactor: 5 (Local) LargePhaseOffset: 50000000 (Local) SpikeWatchPeriod: 900 (Local) LocalClockDispersion: 10 (Local) HoldPeriod: 5 (Local) PhaseCorrectRate: 7 (Local) UpdateInterval: 100 (Local) [TimeProviders] NtpClient (Local) DllName: C:\Windows\system32\w32time.dll (Local) Enabled: 1 (Local) InputProvider: 1 (Local) CrossSiteSyncFlags: 2 (Local) AllowNonstandardModeCombinations: 1 (Local) ResolvePeerBackoffMinutes: 15 (Local) ResolvePeerBackoffMaxTimes: 7 (Local) CompatibilityFlags: 2147483648 (Local) EventLogFlags: 1 (Local) LargeSampleSkew: 3 (Local) SpecialPollInterval: 3600 (Local) Type: NT5DS (Local) NtpServer (Local) DllName: C:\Windows\system32\w32time.dll (Local) Enabled: 1 (Local) InputProvider: 0 (Local) AllowNonstandardModeCombinations: 1 (Local) VMICTimeProvider (Local) DllName: C:\Windows\System32\vmictimeprovider.dll (Local) Enabled: 1 (Local) InputProvider: 1 (Local)

I would look at two things: Check you have 'Time synchronization' unticked in the VM integration services settings (assuming it's under Hyper-V)Is your VM DC set to synchronize its time with one of the other DCs?

I would look at two things: Check you have 'Time synchronization' unticked in the VM integration services settings (assuming it's under Hyper-V)Is your VM DC set to synchronize its time with one of the other DCs? It's ESXI, but they have the same setting, and it is not checked to sync time with the host. I don't know how to check if it's set to sync with the other DC other than the output I posted. I thought everything joined to the domain syncs with the time of the server that has the PDC Emulater FSMO role. If that's the case, then it should be syncing with the other DC.

Ah sorry I answered in a bit of a rush, Type: NT5DS (Local) looks fine. In the security log, do you see any Event ID 4616 entries around that time?

Ah sorry I answered in a bit of a rush, Type: NT5DS (Local) looks fine. In the security log, do you see any Event ID 4616 entries around that time? Event ID 4616 wasn't in the event log. Looks like the time and date change 2 months back every time I restart the virtual machine. Any more ideas on what would make this happen? There are several other virtual machines on this host, and none of them have this problem.

If I reboot into safe mode, the time and date do not change. If i reboot normally the time and date do change. The date goes back exactly 2 months and 10 days every time, and the hours are behind 14 1/2 every time. This is strangely consistent...

The time was set incorrectly on the virtual machines host. Every time the VM rebooted, it synced the time up with the host even though it wasn't set to. I've set the right time on the host and the problem is resolved now. I think I need to post on the VMware forums to find out why the VM was syncing time with the host when it wasn't set to.