A Windows 2003 Server, that is the only DC in the network (192.168.1.10/24), is configured to synchronise its time from another NTP-Server (Linux machine with radio clock, IP 192.168.1.12/24). All that works well as expected.
The DC also provides the endpoint for VPN-connections, hence it obtains a second IP (192.168.1.58/24) as long as a VPN-connection is establised.
If the windows time service is restarted when a VPN-connection exists, it binds to the second IP address as shown in the event log:
source: w32time event ID: 35 The time service is now synchronizing the system time with the time source ntp.xxx.local (ntp.m|0x9|192.168.1.58:123->192.168.1.12:123).
After the VPN-connection is closed, time synchronisation via the 2nd (now released) IP address fails:
source: w32time event ID: 38 (can't reach NTP-Server) event ID: 47 (No attempt to contact a source will be made for 15 minutes.) and finally: event ID: 29 (NtpClient has no source of accurate time.)
After a while, the time service comes up again. But a blackout period is not acceptable for a DC.
Is there any configuration (preferably set via group policies) that instructs windows time service to bind to a specific IP address? Or at least not to bind to the VPN-tunnel's IP address?
The problem persists if the time is synchronised from an internet NTP-server. So this is not an issue, and yes, I want to use the internal (reliable) NTP-server.