Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently trying to shore up the server time across my entire AD domain. The domain has one PDC which hosts all of the FSMO roles and three off-site "backup" DCs (which all get their time from PDC and are all in-sync). The PDC is also set as the only authoritative time server of the domain and gets its time from time.nist.gov. We have several physical servers and dozens of VMware virtual servers, all running either Server 2003, 2008 or 2008R2. Port 123 (both UDP and TCP) is open on our firewall.

I ran a utility on the PDC to determine the time difference on all the servers in the domain and I found that about half a dozen of the 2003 servers (some VM, some physical) are out of sync by 5 minutes and some are out of sync by 10 minutes. Everything else is within a few Seconds or MS of the PDC.

When I log onto these (out of sync) servers, I find that they're all supposedly getting their time from the PDC. A resync will fix the time for about a minute, then they all fall back out of scope to where they were before.

So far I've ensured that the VMs are not set to sync time with the vSphere Client and performed the following on each of the offending servers:

net stop w32time
w32tm /unregister
w32tm /register
net start w32time
W32tm /config /manualpeerlist:[PDCNAME],0x1 /syncfromflags:manual
w32tm /config /update
net stop w32time && net start w32time
w32tm /resync 

They all sync up for about a minute, then fall back out of sync.

I'm not sure where to go from here, any ideas/help is appreciated.

share|improve this question
    
If they're more than 5 minutes out of sync you shouldn't be able to log into them. –  joeqwerty Apr 12 '13 at 18:46
    
I'm able to log in just fine. However some other processes are filling up the event log with failures due to the time differences. –  Xeper Caz Apr 12 '13 at 18:59
    
Do you have any event 520's (pre-2008) or 4616's (2008 and up) in the Security logs? It sounds like maybe there is another process fighting with your system time. –  charleswj81 Apr 14 '13 at 3:07
    
    
The entire (security) log is filled with 520s (successful login/Server 2003) Login/security isn't really the issue, the issue is incorrect time-stamps on a reporting system that runs on a few of these servers. Sometimes this time data is used to determine 'chain of custody' type information. Thankfully the ones that are off are development/test servers, but I'd really like to clean this up either way. –  Xeper Caz Apr 16 '13 at 15:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.