Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have medium-sized Windows network of 60 workstations and 10 servers (2 of which are Domain Controllers). One DC holds the FSMO roles including the PDC Emulator. This the DC with PDC does not sync external time and the time is about 5 minutes behind, causing all the workstations to be behind.

Not sure if I should sync the PDC with an external internet source or just bump the time up manually on this server for now. Right now it's not set to use an external source.

Any suggestions? Is it safe to bump the time up a few minutes manually?

share|improve this question
add comment

2 Answers

Bumping forward in time is usually safe for most applications, but going backwards is bad.

That said, you should be using NTP on at least the PDC to sync with four (yes 4!) external NTP servers. The reasons are complex, but basically you need to ensure that good time servers can "outvote" bad ones. I would suggest using the public NTP pool, which has Geo DNS set up to give you time servers in your own country. Use 0.pool.ntp.org, 1.pool.ntp.org, 2.pool.ntp.org, 3.pool.ntp.org.

Assimung Windows 2003 or later, you can run this command on the PDC emulator to synchronize it:

w32tm /config /manualpeerlist:"0.pool.ntp.org,0x8 1.pool.ntp.org,0x8 2.pool.ntp.org,0x8 3.pool.ntp.org,0x8" /syncfromflags:MANUAL /update 

The hex numbers after each server name tell windows time service to use NTP client mode associations with adaptive poll intervals (which is the right way). You should also consider adding the same to at least one other domain controller, but use "/syncfromflags:ALL" instead so that it talks to the external NTP servers as well as your local domain controllers.

You will need UDP port 123 open outbound on your firewall for any system that talks NTP to the internet. See here for full documentation from MSFT (note you can configure via Group Policy instead of using the command line tools).

share|improve this answer
    
The Microsoft KB article at support.microsoft.com/kb/816042 says to append the ,0x1 flag after each entry and not ,0x8 as you suggested above. Can you point to a source that indicates the correct method? –  SturdyErde Apr 18 '12 at 12:55
1  
the 0x1 tells it to use "special poll interval", which is a fixed 8 hour interval. See the section titled "NtpServer" here, which lists all of the flags, and lists 0x8 as a "client" association: technet.microsoft.com/en-us/library/… –  rmalayter Apr 23 '12 at 12:06
add comment

Are you sure its not using NTP? By default it hits microsoft?

Anyway, you clients should be incync with your DC. Find a good NTP server that you trust, and and update your PDC emulator, Over time your clients will update to match the DC

And yes, you should be ok to bump a few. Like i said though, your clients should be insync with the DC, but not nesscarly insync with the outside world.

share|improve this answer
    
Use multiple NTP servers. The NTP protocol performs better when it has several servers to compare with each other. –  Martijn Heemels Jan 30 '12 at 22:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.