Found an interesting issue; I thought we'd be safe allowing VMware tools to update the guest time on our VMs; it turns out that in a domain setting this is a bad idea. If anything happens to the VMware clock, things go badly. This is true even though I configured VMware to pulls its time via NTP from pool.ntp.org. I found that VM clock times were drifting and this was causing havoc with domain and authentication services. When you have problems with those basic services, many other strange unexplained problems will arise. The best way to handle the situation is to configure AD to distribute time as it it designed to and to totally turn off VMware tools time synchronization unless you need it for a specific reason.

Note that part of AD domain services is a basic time service that all member computers get their time from by default without any configuration

Here are the details on how to configure AD properly:

Please note that pool.ntp.org is a free/public and reliable NTP source that is comprised of multiple geographically distributed time servers.

Read the original post:

Active Directory, NTP and VMware | http://www.extropy.com