I have a Windows Server 2008 R2 domain controller and a bunch of workstations of various versions of Windows - XP SP3, Vista, 7, 8.1. Time sync wasn't working correctly on a few PCs so I followed the directions found on this page: http://techlauve.com/how-to-time-sync-across-windows-network/ to apply a GPO to make the server sync time with a NTP source (I used pool.ntp.org instead of the old Windows Time server), and another GPO to make all the workstations sync with the DC.
Some workstations were already syncing with the DC so I figured this would be pretty smooth.
Well, was I ever wrong. I force-updated a few workstations (gpupdate /force) and they worked fine, showed the server as the time source (yay), and so I went back to what I was doing before. Two hours later... all hell broke loose.
Basically all of my workstations that are newer than Windows XP are now flooding the network with ARP requests. To get on the internet to type this I had to unplug 95% of the workstations from the switch in the server room.
I ran wireshark on this machine (Windows 7 SP1 64-bit) and it's full of exciting data like:
Broadcast ARP 60 Who has 192.168.1.1? Tell 192.168.1.51 Broadcast ARP 60 Who has 192.168.1.53? Tell 192.168.1.50 Broadcast ARP 60 Who has 192.168.1.2? Tell 192.168.1.48 Broadcast ARP 60 Who has 192.168.1.253? Tell 192.168.1.51 Broadcast ARP 60 Who has 192.168.1.1? Tell 192.168.1.53
Plus thousands and thousands and thousands more lines like that in the span of minutes.
192.168.1.1 is the router/firewall. 2 is the server, .253 and .254 are network printers (HP somethings), everything > 30 and <200 is a workstation.
What on earth did I do wrong???
Thanks for any help.
Edit: further discovery. Changing the group policy for the workstations so they pull time directly from pool.ntp.org instead of my server resulted in the PCs that received the updated group policy stopping flooding the network. This still does not answer why "time from server = ARP flood" though, and I'd rather have all my workstations sync to my server instead of external time sources.
Plus, I have some older workstations that are so busy shouting their ARP requests that they can't pull in new group policies.