I'm currently trying to shore up the server time across my entire AD domain. The domain has one PDC which hosts all of the FSMO roles and three off-site "backup" DCs (which all get their time from PDC and are all in-sync). The PDC is also set as the only authoritative time server of the domain and gets its time from time.nist.gov. We have several physical servers and dozens of VMware virtual servers, all running either Server 2003, 2008 or 2008R2. Port 123 (both UDP and TCP) is open on our firewall.
I ran a utility on the PDC to determine the time difference on all the servers in the domain and I found that about half a dozen of the 2003 servers (some VM, some physical) are out of sync by 5 minutes and some are out of sync by 10 minutes. Everything else is within a few Seconds or MS of the PDC.
When I log onto these (out of sync) servers, I find that they're all supposedly getting their time from the PDC. A resync will fix the time for about a minute, then they all fall back out of scope to where they were before.
So far I've ensured that the VMs are not set to sync time with the vSphere Client and performed the following on each of the offending servers:
net stop w32time w32tm /unregister w32tm /register net start w32time W32tm /config /manualpeerlist:[PDCNAME],0x1 /syncfromflags:manual w32tm /config /update net stop w32time && net start w32time w32tm /resync
They all sync up for about a minute, then fall back out of sync.
I'm not sure where to go from here, any ideas/help is appreciated.