Не синхронизируется время

[deem73]

пока так
Служба не стартует
Добавил пользователя LOCAL SERVICE на ветвь реестра w32time

C:\Windows\System32>w32tm /monitor
Server.systema.if *** PDC ***[[::1]:123]:
ICMP: 0ms delay
NTP: error WSAECONNRESET - no server listening on NTP port

C:\Windows\System32>w32tm /resync
The following error occurred: The service has not been started. (0x80070426)

C:\Windows\System32>w32tm /config /update /manualpeerlist:"0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org" /syncfromflags:MANUAL /reliable:yes
The following error occurred: The service has not been started. (0x80070426)

C:\Windows\System32>net start w32time
System error 1290 has occurred.

The service start failed since one or more services in the same process have an incompatible service SID type setting. A service with restricted service SID type can only coexi
st in the same process with other services with a restricted SID type. If the service SID type for this service was just configured, the hosting process must be restarted in or
der to start this service.

[NickM]

Служба не стартует »
C:\Windows\System32>net start w32time
System error 1290 has occurred. »

Переведите и попробуйте понять ответ;

Добавил пользователя LOCAL SERVICE на ветвь реестра w32time »
Если Вы будете делать только то, что Сами считаете нужным, и опускать большую часть, того, что Вас просят, то скорее всего диалог у Нас дальше не выстроится;

PS C:\Windows\system32> Get-Acl -Path HKLM:\SYSTEM\CurrentControlSet\Services\W32Time | Format-List
Path : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time
Owner : NT AUTHORITY\СИСТЕМА
Group : NT AUTHORITY\СИСТЕМА »


Гуглёж подсказывает, пробуйте: system error 1290 after register w32time service (https://social.technet.microsoft.com/Forums/windows/en-US/5828b5a6-9f70-4129-a086-34c25c1fe948/system-error-1290-after-register-w32time-service?forum=winservergen)

[deem73]

Если Вы будете делать только то, что Сами считаете нужным, и опускать большую часть, того, что Вас просят, то скорее всего диалог у Нас дальше не выстроится;
Сорри. Просто я пробую разные варианты.

Сделал всё заново.
C:\Windows\System32>w32tm /unregister
W32Time successfully unregistered.

C:\Windows\System32>w32tm /register
W32Time successfully registered.

C:\Windows\System32>sc config w32time type= own
[SC] ChangeServiceConfig SUCCESS

C:\Windows\System32>net start w32time
The Windows Time service is starting.
The Windows Time service was started successfully.


C:\Windows\System32>w32tm /config /update /manualpeerlist:"0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org",0x8 /syncfromflags:MANUAL /reliable:yes
The command completed successfully.

C:\Windows\System32>w32tm /resync
Sending resync command to local computer
The following error occurred: Access is denied. (0x80070005)

C:\Windows\System32>w32tm /resync
Sending resync command to local computer
The following error occurred: Access is denied. (0x80070005)

C:\Windows\System32>w32tm /monitor
Server.systema.if *** PDC ***[[::1]:123]:
ICMP: 0ms delay
NTP: +0.0000000s offset from Server.systema.if
RefID: 'LOCL' [0x4C434F4C]
Stratum: 1

Warning:
Reverse name resolution is best effort. It may not be
correct since RefID field in time packets differs across
NTP implementations and may not be using IP addresses.

Тут так:
PS C:\Users\Administrator> Get-Acl -Path HKLM:\SYSTEM\CurrentControlSet\Services\W32Time | Format-List


Path : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time
Owner : BUILTIN\Administrators
Group : NT AUTHORITY\SYSTEM
Access : NT AUTHORITY\Authenticated Users Allow ReadKey
NT AUTHORITY\Authenticated Users Allow -2147483648
BUILTIN\Server Operators Allow SetValue, CreateSubKey, Delete, ReadKey
BUILTIN\Server Operators Allow -1073676288
BUILTIN\Administrators Allow FullControl
BUILTIN\Administrators Allow 268435456
NT AUTHORITY\SYSTEM Allow FullControl
NT AUTHORITY\SYSTEM Allow 268435456
CREATOR OWNER Allow 268435456
Audit :
Sddl : O:BAG:SYD:AI(A;ID;KR;;;AU)(A;CIIOID;GR;;;AU)(A;ID;CCDCLCSWRPSDRC;;;SO)(A;CIIOID;SDGWGR;;;SO)(A;ID;KA ;;;BA)(A;CIIOID;GA;;;BA)(A;ID;KA;;;SY)(A;CIIOID;GA;;;SY)(A;CIIOID;GA;;;CO)

Статью перечитал. Насколько я понял, мне нужно поменять ключ в реестре
поставить "...svchost.exe -k NetworkService" вместо "...svchost.exe -k tapisrv" и перегрузить сервер.
2.Locate the following registry subkey, and then click it:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv

3.In the details pane, right-click ImagePath , and then click Modify .
4.In the Value data box, type the following registry value, and then click OK :

%SystemRoot%\System32\svchost.exe -k NetworkService

Note: If NetworkService does not appear in the %SystemRoot%\System32\svchost.exe -k NetworkService registry value, the problem that is described in the "Symptoms" section may occur.

5.Exit Registry Editor, and then restart the computer.

[deem73]

Еще я вычитал, что порт 123 должен находится в состоянии прослушивания. А он у меня не прослушивается.
Please make sure that the account that you use to run the command “w32tm /resync /computer:client1” is member of the group Administrators on the client1 machine.



If the account is member of the group Administrators, I suggest checking:



· The state of the port 123 is LISTENING.

· The status of Server service is started.

· Open the local group policy editor to ensure that the SERVICE account has the User Right Assignment for “Impersonate a Client After Authentication”.
(Computer Configuration\Windows Settings\Security Setting\Local Policies\User Right Assignment)



In addition, please logon client1 with this account and run the command “w32tm /resync” to check the result.

[NickM]

Статью перечитал. Насколько я понял, мне нужно поменять ключ в реестре »
Нет, ничего менять не нужно;

Сделал всё заново. »
Просто я пробую разные варианты.
Сделал всё заново. »
Вы сильно и куда то спешите.
Сначала Вам следует заставить работать службу корректно, а уже после её настраивать;

Еще я вычитал, что порт 123 должен находится в состоянии прослушивания. А он у меня не прослушивается. »
Вы вначале со службой разберитесь, а после уже с портами будете разбираться;

Owner : BUILTIN\Administrators »
Owner : NT AUTHORITY\СИСТЕМА »
И сравните все те права что у Вас, и что приводил для Вас выше;

Также покажите результаты:
reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer

The following error occurred: Access is denied. (0x80070005)
Когда наблюдается проблема с правами доступа, иногда помогает логгирование с помощью "Process Monitor". »

[deem73]

C:\Windows\System32>reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
ServiceDllUnloadOnStop REG_DWORD 0x1
ServiceMain REG_SZ SvchostEntry_W32Time
ServiceDll REG_EXPAND_SZ C:\Windows\System32\w32time.DLL
Type REG_SZ NTP
NtpServer REG_SZ 0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org,0x8


C:\Windows\System32>reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
Enabled REG_DWORD 0x1
InputProvider REG_DWORD 0x1
AllowNonstandardModeCombinations REG_DWORD 0x1
CrossSiteSyncFlags REG_DWORD 0x2
ResolvePeerBackoffMinutes REG_DWORD 0xf
ResolvePeerBackoffMaxTimes REG_DWORD 0x7
CompatibilityFlags REG_DWORD 0x80000000
EventLogFlags REG_DWORD 0x1
LargeSampleSkew REG_DWORD 0x3
DllName REG_EXPAND_SZ C:\Windows\System32\w32time.DLL
SpecialPollTimeRemaining REG_MULTI_SZ
SpecialPollInterval REG_DWORD 0xe10


C:\Windows\System32>reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer
InputProvider REG_DWORD 0x0
AllowNonstandardModeCombinations REG_DWORD 0x1
EventLogFlags REG_DWORD 0x0
DllName REG_EXPAND_SZ C:\Windows\System32\w32time.DLL
Enabled REG_DWORD 0x1

Цитата deem73:
Owner : BUILTIN\Administrators »
Цитата NickM:
Owner : NT AUTHORITY\СИСТЕМА »
Да, я вижу, что отличаются.

Настроил фильтры для procmon и промониторил выполнение команды C:\Windows\System32>w32tm /query /status
The following error occurred: Access is denied. (0x80070005)

"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"17:09:29.7226551","CNABHSWD.EXE","7528","FileSystemControl","\\magnum\pipe\CanonCAPT40","SUCCESS","Control: FSCTL_PIPE_TRANSCEIVE, WriteLength: 1*024, ReadLength: 228"
"17:09:29.7456873","BATReport.exe","9656","Thread Exit","","SUCCESS","Thread ID: 12836, User Time: 0.0000000, Kernel Time: 0.0000000"
"17:09:30.5565169","mfevtps.exe","2496","Thread Exit","","SUCCESS","Thread ID: 12428, User Time: 0.0000000, Kernel Time: 0.0000000"
"17:09:30.6635484","VsTskMgr.exe","2140","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"17:09:30.6635735","VsTskMgr.exe","2140","RegQueryKey","HKLM","SUCCESS","Query: Name"
"17:09:30.6636030","VsTskMgr.exe","2140","RegOpenKey","HKLM\Software\Wow6432Node","SUCCESS","Desired Access: Read/Write"
"17:09:30.6637088","VsTskMgr.exe","2140","RegSetInfoKey","HKLM\SOFTWARE\Wow6432Node","SUCCESS","KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
"17:09:30.6637297","VsTskMgr.exe","2140","RegCloseKey","HKLM\SOFTWARE\Wow6432Node","SUCCESS",""
"17:09:30.6637497","VsTskMgr.exe","2140","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"17:09:30.6637651","VsTskMgr.exe","2140","RegQueryKey","HKLM","SUCCESS","Query: Name"
"17:09:30.6637873","VsTskMgr.exe","2140","RegOpenKey","HKLM\Software\Wow6432Node","SUCCESS","Desired Access: Read/Write"
"17:09:30.6638389","VsTskMgr.exe","2140","RegSetInfoKey","HKLM\SOFTWARE\Wow6432Node","SUCCESS","KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
"17:09:30.6638577","VsTskMgr.exe","2140","RegCloseKey","HKLM\SOFTWARE\Wow6432Node","SUCCESS",""
"17:09:30.7291490","mfevtps.exe","2496","CreateFile","C:\Windows\System32\dhcpcore.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"17:09:30.7293149","mfevtps.exe","2496","QueryStandardInformationFile","C:\Windows\System32\dhcpcore.dll","SUCCESS","AllocationSize: 319*488, EndOfFile: 318*976, NumberOfLinks: 4, DeletePending: False, Directory: False"
"17:09:30.7293636","mfevtps.exe","2496","CreateFileMapping","C:\Windows\System32\dhcpcore.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "
"17:09:30.7293909","mfevtps.exe","2496","QueryStandardInformationFile","C:\Windows\System32\dhcpcore.dll","SUCCESS","AllocationSize: 319*488, EndOfFile: 318*976, NumberOfLinks: 4, DeletePending: False, Directory: False"
"17:09:30.7295842","mfevtps.exe","2496","Thread Create","","SUCCESS","Thread ID: 11920"
"17:09:30.7298414","mfevtps.exe","2496","RegOpenKey","HKLM\System\CurrentControlSet\Control\Cryptography\Providers","REPARSE","Desired Access: Read"
"17:09:30.7298943","mfevtps.exe","2496","RegOpenKey","HKLM\System\CurrentControlSet\Control\Cryptography\Providers","SUCCESS","Desired Access: Read"
"17:09:30.7299408","mfevtps.exe","2496","RegCloseKey","HKLM\System\CurrentControlSet\Control\Cryptography\Providers","SUCCESS",""
"17:09:30.7299746","mfevtps.exe","2496","RegOpenKey","HKLM\System\CurrentControlSet\Control\Cryptography\Configuration","REPARSE","Desired Access: Read"
"17:09:30.7300100","mfevtps.exe","2496","RegOpenKey","HKLM\System\CurrentControlSet\Control\Cryptography\Configuration","SUCCESS","Desired Access: Read"
"17:09:30.7300488","mfevtps.exe","2496","RegCloseKey","HKLM\System\CurrentControlSet\Control\Cryptography\Configuration","SUCCESS",""
"17:09:30.7301094","mfevtps.exe","2496","RegOpenKey","HKLM\System\CurrentControlSet\Control\Cryptography\Providers","REPARSE","Desired Access: Read"
"17:09:30.7301461","mfevtps.exe","2496","RegOpenKey","HKLM\System\CurrentControlSet\Control\Cryptography\Providers","SUCCESS","Desired Access: Read"
"17:09:30.7301845","mfevtps.exe","2496","RegCloseKey","HKLM\System\CurrentControlSet\Control\Cryptography\Providers","SUCCESS",""
"17:09:30.7302169","mfevtps.exe","2496","RegOpenKey","HKLM\System\CurrentControlSet\Control\Cryptography\Configuration","REPARSE","Desired Access: Read"
"17:09:30.7302510","mfevtps.exe","2496","RegOpenKey","HKLM\System\CurrentControlSet\Control\Cryptography\Configuration","SUCCESS","Desired Access: Read"
"17:09:30.7302881","mfevtps.exe","2496","RegCloseKey","HKLM\System\CurrentControlSet\Control\Cryptography\Configuration","SUCCESS",""
"17:09:30.7303385","mfevtps.exe","2496","QueryStandardInformationFile","C:\Windows\System32\dhcpcore.dll","SUCCESS","AllocationSize: 319*488, EndOfFile: 318*976, NumberOfLinks: 4, DeletePending: False, Directory: False"
"17:09:30.7303654","mfevtps.exe","2496","CreateFileMapping","C:\Windows\System32\dhcpcore.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "
"17:09:30.7303927","mfevtps.exe","2496","QueryStandardInformationFile","C:\Windows\System32\dhcpcore.dll","SUCCESS","AllocationSize: 319*488, EndOfFile: 318*976, NumberOfLinks: 4, DeletePending: False, Directory: False"
"17:09:30.7317811","mfevtps.exe","2496","CloseFile","C:\Windows\System32\dhcpcore.dll","SUCCESS",""
"17:09:30.7425603","CNABHSWD.EXE","7528","FileSystemControl","\\magnum\pipe\CanonCAPT40","SUCCESS","Control: FSCTL_PIPE_TRANSCEIVE, WriteLength: 1*024, ReadLength: 228"
"17:09:31.3571145","cmd.exe","6700","ReadFile","C:\Windows\System32\cmd.exe","SUCCESS","Offset: 300*032, Length: 10*240, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"
"17:09:31.3691025","cmd.exe","6700","ReadFile","C:\Windows\System32\cmd.exe","SUCCESS","Offset: 173*568, Length: 6*656, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"
"17:09:31.3806319","cmd.exe","6700","CreateFile","C:\Windows\System32","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"17:09:31.3807548","cmd.exe","6700","QueryDirectory","C:\Windows\System32\w32tm.*","SUCCESS","Filter: w32tm.*, 1: w32tm.exe"
"17:09:31.3808077","cmd.exe","6700","CloseFile","C:\Windows\System32","SUCCESS",""
"17:09:31.3809519","cmd.exe","6700","CreateFile","C:\Windows\System32","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"17:09:31.3810185","cmd.exe","6700","QueryDirectory","C:\Windows\System32\w32tm.COM","NO SUCH FILE","Filter: w32tm.COM"
"17:09:31.3810466","cmd.exe","6700","CloseFile","C:\Windows\System32","SUCCESS",""
"17:09:31.3811614","cmd.exe","6700","CreateFile","C:\Windows\System32","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"17:09:31.3812258","cmd.exe","6700","QueryDirectory","C:\Windows\System32\w32tm.EXE","SUCCESS","Filter: w32tm.EXE, 1: w32tm.exe"
"17:09:31.3812578","cmd.exe","6700","CloseFile","C:\Windows\System32","SUCCESS",""
"17:09:31.3815637","cmd.exe","6700","CreateFile","C:\Windows\System32","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"17:09:31.3816162","cmd.exe","6700","QueryBasicInformationFile","C:\Windows\System32","SUCCESS","CreationTime: 14.07.2009 5:20:10, LastAccessTime: 09.11.2022 2:26:50, LastWriteTime: 09.11.2022 2:26:50, ChangeTime: 09.11.2022 2:26:50, FileAttributes: D"
"17:09:31.3816375","cmd.exe","6700","CloseFile","C:\Windows\System32","SUCCESS",""
"17:09:31.3817818","cmd.exe","6700","CreateFile","C:\Windows\System32\w32tm.exe","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"17:09:31.3820924","cmd.exe","6700","CreateFileMapping","C:\Windows\System32\w32tm.exe","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "
"17:09:31.3821922","cmd.exe","6700","CreateFileMapping","C:\Windows\System32\w32tm.exe","SUCCESS","SyncType: SyncTypeOther"
"17:09:31.3822566","cmd.exe","6700","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32tm.exe","NAME NOT FOUND","Desired Access: Query Value, Enumerate Sub Keys"
"17:09:31.3822997","cmd.exe","6700","QuerySecurityFile","C:\Windows\System32\w32tm.exe","SUCCESS","Information: Label"
"17:09:31.3825523","cmd.exe","6700","Process Create","C:\Windows\System32\w32tm.exe","SUCCESS","PID: 10892, Command line: w32tm /query /status"
"17:09:31.3825651","w32tm.exe","10892","Process Start","","SUCCESS","Parent PID: 6700, Command line: w32tm /query /status, Current directory: C:\Windows\System32\, Environment:
; =C:=C:\Windows\System32
; =ExitCode=80070005
; ALLUSERSPROFILE=C:\ProgramData
; APPDATA=C:\Users\Administrator\AppData\Roaming
; CLIENTNAME=ADMIN
; CommonProgramFiles=C:\Program Files\Common Files
; CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
; CommonProgramW6432=C:\Program Files\Common Files
; COMPUTERNAME=SERVER
; ComSpec=C:\Windows\system32\cmd.exe
; DEFLOGDIR=C:\ProgramData\McAfee\DesktopProtection
; FP_NO_HOST_CHECK=NO
; HOMEDRIVE=C:
; HOMEPATH=\Users\Administrator
; Isuser=C:\Users\ADMINI~1\AppData\Local\Temp\2\{B735D97E-0710-4FF9-8164-F61CC3A2E9FE}\{BCE9F441-9027-4911-82E0-5FB28057897D}\_isuser_0x0409.dll
; LOCALAPPDATA=C:\Users\Administrator\AppData\Local
; LOGONSERVER=\\SERVER
; MPosPath=C:\MPos3\
; NUMBER_OF_PROCESSORS=4
; OS=Windows_NT
; Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v 1.0\
; PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
; PROCESSOR_ARCHITECTURE=AMD64
; PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 30 Stepping 5, GenuineIntel
; PROCESSOR_LEVEL=6
; PROCESSOR_REVISION=1e05
; ProgramData=C:\ProgramData
; ProgramFiles=C:\Program Files
; ProgramFiles(x86)=C:\Program Files (x86)
; ProgramW6432=C:\Program Files
; PROMPT=$P$G
; PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
; PUBLIC=C:\Users\Public
; SESSIONNAME=ts#5
; SystemDrive=C:
; SystemRoot=C:\Windows
; TEMP=C:\Users\ADMINI~1\AppData\Local\Temp\1
; TMP=C:\Users\ADMINI~1\AppData\Local\Temp\1
; USERDNSDOMAIN=SYSTEMA.IF
; USERDOMAIN=SYSTEMA
; USERDOMAIN_ROAMINGPROFILE=SYSTEMA
; USERNAME=admin5
; USERPROFILE=C:\Users\Administrator
; VSEDEFLOGDIR=C:\ProgramData\McAfee\DesktopProtection
; windir=C:\Windows
; windows_tracing_flags=3
; windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log"
"17:09:31.3825775","w32tm.exe","10892","Thread Create","","SUCCESS","Thread ID: 12616"
"17:09:31.3829094","cmd.exe","6700","QuerySecurityFile","C:\Windows\System32\w32tm.exe","SUCCESS","Information: Owner, Group, DACL, SACL, Label"
"17:09:31.3829338","cmd.exe","6700","QueryBasicInformationFile","C:\Windows\System32\w32tm.exe","SUCCESS","CreationTime: 05.09.2020 22:34:45, LastAccessTime: 05.09.2020 22:34:45, LastWriteTime: 05.09.2020 22:34:45, ChangeTime: 05.09.2020 22:47:47, FileAttributes: A"
"17:09:31.3829636","cmd.exe","6700","RegOpenKey","HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers","SUCCESS","Desired Access: Query Value"
"17:09:31.3830007","cmd.exe","6700","RegQueryValue","HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Windows\System32\w32tm.exe","NAME NOT FOUND","Length: 16"
"17:09:31.3830212","cmd.exe","6700","RegCloseKey","HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers","SUCCESS",""
"17:09:31.3830425","cmd.exe","6700","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\w32tm.exe","NAME NOT FOUND","Desired Access: Query Value"
"17:09:31.3830750","cmd.exe","6700","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","Desired Access: Read"
"17:09:31.3830997","cmd.exe","6700","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest","NAME NOT FOUND","Length: 20"
"17:09:31.3831168","cmd.exe","6700","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS",""
"17:09:31.3832448","csrss.exe","592","QuerySecurityFile","C:\Windows\System32\w32tm.exe","SUCCESS","Information: Owner, Group, DACL, SACL, Label"
"17:09:31.3832670","csrss.exe","592","QueryBasicInformationFile","C:\Windows\System32\w32tm.exe","SUCCESS","CreationTime: 05.09.2020 22:34:45, LastAccessTime: 05.09.2020 22:34:45, LastWriteTime: 05.09.2020 22:34:45, ChangeTime: 05.09.2020 22:47:47, FileAttributes: A"
"17:09:31.3833647","csrss.exe","592","CreateFile","C:\Windows\System32\w32tm.exe.Config","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, Impersonating: SYSTEMA\admin5"
"17:09:31.3834402","csrss.exe","592","QueryBasicInformationFile","C:\Windows\System32\w32tm.exe","SUCCESS","CreationTime: 05.09.2020 22:34:45, LastAccessTime: 05.09.2020 22:34:45, LastWriteTime: 05.09.2020 22:34:45, ChangeTime: 05.09.2020 22:47:47, FileAttributes: A"
"17:09:31.3834577","csrss.exe","592","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PublisherPolicyChangeTime","SUCCESS","Type: REG_QWORD, Length: 8, Data: "
"17:09:31.3835912","cmd.exe","6700","CloseFile","C:\Windows\System32\w32tm.exe","SUCCESS",""
"17:09:31.3836066","w32tm.exe","10892","QueryNameInformationFile","C:\Windows\System32\w32tm.exe","SUCCESS","Name: \Windows\System32\w32tm.exe"
"17:09:31.3837291","w32tm.exe","10892","Load Image","C:\Windows\System32\w32tm.exe","SUCCESS","Image Base: 0xff880000, Image Size: 0x17000"
"17:09:31.3838302","w32tm.exe","10892","Load Image","C:\Windows\System32\ntdll.dll","SUCCESS","Image Base: 0x77430000, Image Size: 0x19f000"
"17:09:31.3839185","w32tm.exe","10892","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options","SUCCESS","Desired Access: Query Value, Enumerate Sub Keys"
"17:09:31.3839539","w32tm.exe","10892","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DisableUserModeCallbackFilter","NAME NOT FOUND","Length: 1*024"
"17:09:31.3839795","w32tm.exe","10892","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","REPARSE","Desired Access: Read"
"17:09:31.3840043","w32tm.exe","10892","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Read"
"17:09:31.3840243","w32tm.exe","10892","RegQueryValue","HKLM\System\CurrentControlSet\Control\SESSION MANAGER\CWDIllegalInDLLSearch","NAME NOT FOUND","Length: 1*024"
"17:09:31.3840414","w32tm.exe","10892","RegCloseKey","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS",""
"17:09:31.3843089","w32tm.exe","10892","CreateFile","C:\Windows\System32","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"17:09:31.3846617","w32tm.exe","10892","Load Image","C:\Windows\System32\kernel32.dll","SUCCESS","Image Base: 0x77310000, Image Size: 0x11f000"
"17:09:31.3849843","w32tm.exe","10892","Load Image","C:\Windows\System32\KernelBase.dll","SUCCESS","Image Base: 0x7fefd4b0000, Image Size: 0x6a000"
"17:09:31.3861158","w32tm.exe","10892","RegOpenKey","HKLM\System\CurrentControlSet\Control\SafeBoot\Option","REPARSE","Desired Access: Query Value, Set Value"
"17:09:31.3861713","w32tm.exe","10892","RegOpenKey","HKLM\System\CurrentControlSet\Control\SafeBoot\Option","NAME NOT FOUND","Desired Access: Query Value, Set Value"
"17:09:31.3862105","w32tm.exe","10892","RegOpenKey","HKLM\System\CurrentControlSet\Control\Srp\GP\DLL","REPARSE","Desired Access: Read"
"17:09:31.3862310","w32tm.exe","10892","RegOpenKey","HKLM\System\CurrentControlSet\Control\Srp\GP\DLL","NAME NOT FOUND","Desired Access: Read"
"17:09:31.3862511","w32tm.exe","10892","RegOpenKey","HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","SUCCESS","Desired Access: Query Value"
"17:09:31.3862733","w32tm.exe","10892","RegQueryValue","HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled","NAME NOT FOUND","Length: 80"
"17:09:31.3862890","w32tm.exe","10892","RegCloseKey","HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers","SUCCESS",""
"17:09:31.3863215","w32tm.exe","10892","RegOpenKey","HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","NAME NOT FOUND","Desired Access: Query Value"
"17:09:31.3864584","w32tm.exe","10892","Load Image","C:\Windows\System32\advapi32.dll","SUCCESS","Image Base: 0x7fefeb00000, Image Size: 0xdb000"
"17:09:31.3866543","w32tm.exe","10892","Load Image","C:\Windows\System32\msvcrt.dll","SUCCESS","Image Base: 0x7fefd580000, Image Size: 0x9f000"
"17:09:31.3869755","w32tm.exe","10892","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
....


Файл целиком во вложении.
Что можно ещё посмотреть?

[NickM]

Файл целиком во вложении. »
Настроил фильтры для procmon »
Подозрительно маленький файл, мало событий и не в формате *.pml - тогда, когда отдаёшь файл для анализа, то самостоятельно настраивать фильтры не следует;

По параметрам реестра, в принципе, замечаний нет, кроме того, как - незачем лепить кучу серверов из пула ntp.org, т.к. следует понимать, как именно работает пул.

The following error occurred: Access is denied. (0x80070005) »
А вот с этим следует разбираться, да.

[deem73]

Подозрительно маленький файл, мало событий и не в формате *.pml - тогда, когда отдаёшь файл для анализа, то самостоятельно настраивать фильтры не следует; »

У менять есть и pwl файл. Он очень большой и на форум не поместится. Я думаю, что он без фильтров.

Фильтры я включил, потому что сыпется очень много событий, что procmon тупо зависал, и ничего там нельзя было сделать.

[NickM]

У менять есть и pml файл. Он очень большой и на форум не поместится. Я думаю, что он без фильтров. »
Пакуйте, можете с паролем, заливайте в облако, ссылку тут или в личные.

Сейчас Ваша задача понять, что Вас ограничивает в доступе, не исключено, что ранее упомянутый "защитничег", т.к. некоторые защитные решения рьяно оберегают изменение системного времени, например тот же "Dr.Web" так же, по умолчанию, ограничивает администратора в правке оного:
https://forum.drweb.com/uploads/monthly_08_2016/post-1396-0-36777500-1470220562_thumb.png

[deem73]

Отправил в личку.
Антивирус всё время был отключен. Кроме того, когда его внедряли централизовано по всей структуре, его настройка обчуждалась в сисадминском чате, но на приостановку времени никто не жаловался, а внедряли его после эпидемии вируса "Петя". Антивирус конечно много чего блокирует, но обо всём он пишет в журнал, поэтому я туда всегда смотрю в сомнительных случаях и по необходимости прописываю исключения.

Время на сервере можно менять без проблем. Антивирус не блокирует.

[deem73]

Смотрю PML файл и удивляюсь, зачем команда w32tm создает кучу dll в папке system32 и ещё проставляет там прошедшую дату создания?

На другом серевер стоит точно такойже антивирус, и всё там отлично обновляется в плане времени. Разница - он не в домене.

[NickM]

Время на сервере можно менять без проблем. Антивирус не блокирует. »
Права, всё дело в правах пользователей/ учётных записей служб/ пр., ну и в защитном ПО, что тоже не исключение.

А также в состоянии самой системы, Вы sfc удовлетворили в его запросе?
Теперь он не жалуется на системные файлы?

[NickM]

А также в состоянии самой системы, Вы sfc удовлетворили в его запросе?
Теперь он не жалуется на системные файлы? »
?

В логе из подозрительного вижу только это:
Environment:
=ExitCode=80070005
чтобы это значило, ума не приложу... может библиотеку какую не получилось проинициализировать, может какой COM-интерфейс :dont-know

Но, Я бы ещё заглянул в системные журналы, может получится одно с другим cвязать?
C:\Windows\System32\winevt\Logs\Application.evtx
C:\Windows\System32\winevt\Logs\System.evtx


Добавлю, может у Вас с пользователями какая-нибудь катавасия?
Страт процесса w32tm.exe именно по пользователю вызывает вопросы.

[deem73]

SFC ещё раз запустил.

Могу выложить системные журналы в личку.

С пользователями тоже творится нехорошая вещь, они авторизуются дольше обычного на сервере. А в остальном норм.

Страт процесса w32tm.exe именно по пользователю вызывает вопросы.
Вот это непонятно, что за страт?

[NickM]

Вот это непонятно, что за страт? »
Упс, старт процесса;

С пользователями тоже творится нехорошая вещь, они авторизуются дольше обычного на сервере. »
Вы используете перемещаемые профили?

Видно, что Вы запускаете процесс в терминальной сессии из-под какой-то доменной УЗ, которая, по видимому и ограничена в правах, при этом ссылка на профиль пользователя "Administrator" на сервере.

[deem73]

Перемещаемые профили не использую. Просто если при логине вводишь, неправильный пароль, домен долго отзывается, чтобы выдать сообщение про ошибочный пароль. На некоторой машине - вообще нельзя было зайти, пока патчкорд был воткнут. Патчкорд вытаскиваешь - нормально логинится.

Запускаю под своей учеткой администратора, я её никак не ограничивал.

C:\Windows\System32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files and successfully repaired
them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log

C:\Windows\System32>w32tm /query /status
The following error occurred: Access is denied. (0x80070005)

C:\Windows\System32>

[DJ Mogarych]

Начните с этого:
https://learn.microsoft.com/en-us/services-hub/health/remediation-steps-ad/configure-the-root-pdc-with-an-authoritative-time-source-and-avoid-widespread-time-skew

Что касается серверов времени, то нужно вписывать только один: pool.ntp.org
Это пул из нескольких сотен серверов, больше ничего не надо.

[NickM]

Начните с этого: »
Тут проблема с
ExitCode=80070005

Полагаю, что Petya V4sechkin смог бы разобраться, призвать бы его :help: