Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

Our Domain Controller/Active directory Windows 2008 server is running 5 mins slow, so all the client PCs are also showing the slower time.

Is it safe to change the time on the server? And while the users are still logged on?

Also whats the best way to make sure the time is always correct/synced?

Thanks S

share|improve this question

1 Answer

up vote 3 down vote accepted

Set your Domain Controller to sync with an Internet time source (if you have more than one Domain Controller then do this on the one holding the PDC emulator role).

w32tm /config /manualpeerlist:"pool.ntp.org" /reliable:yes /update

Replace pool.ntp.org with your preferred NTP source.

It's safe to do this while people are logged on. The time on your domain computers will eventually re-sync and correct themselves. If you want to do this quickly on a machine then just restart the Windows Time service.

share|improve this answer
3  
I would be careful about making a change of 5 minutes or greater all at once. If clock is off by more than 5 min, kerberos auth will fail. If your DC syncs, and it's several hour until workstations sync, there will probably be kerberos issues. Would suggest manually correcting DC time by 2 minutes, wait a day. Correct DC by another 2 minutes, wait a day. Then setup NTP sync on the DC. – Craig620 Sep 7 '12 at 13:44
+1 good point there. – Chris McKeown Sep 7 '12 at 13:46
@Craig620 Actually, authentication works just fine with time differences larger than the kerberos tolerance. support.microsoft.com/kb/956627 – Shane Madden Sep 8 '12 at 7:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.