I have a DMZ machine that i wish to sync to a time source ().pool.ntp.org. Perimeter Firewall is setup to allow relevant ports through. Obviously local FW on the server is on and configured to allow again, the relevant ports through for time sync. The configurations in the registry have been checked for the windows time service: the server is not a domain member (in DMZ). --i.e. it is an NTP 'type' configuration.

so i.e the various registry settings have been set. my question is this.

I open the GUI to adjust the time settings and open the internet setting tab and insert the pool.ntp address--this is fine! i ask it to update by clicking the button and i get an error about ".....time expired" not fine but stay with me, when i go to the command line i type w32tm /query /status or w32tm /query /source the info that comes back is (among other things) source:Local CMOS Clock and when i type w32tm /rsync i get ".....no time data was available".

I followed a fair amount of advice from various posts on the net to no avail. from the command line with w32tm i am always getting "source:Local CMOS Clock" this may or may not matter and is probably the reason why i get the "....no data available" message for the resync.

I have not been able to get a "successfully synched message" from my manual efforts and i am waiting for the automated synch messages.

Win 2003 from my internal network is working fine....no issues.

Does anyone have an expanation as to why the command line and the gui can be so different? There is three (registry, date/time GUI, w32tm command line tool) ways to set the ntp server as far as i can see and i expect that they should all be linked to the same mechanism. Very frustrating......

If i set the ntp server in the GUI, i expect it to be reflected in the command line and the registry. am i worng in this belief???? P.S event viewer on the server does not indicate anything untoward -(a lot of schannel errors and that is another problem i guess)....i will keep an eye out though. here are the outputs for the w32tm CLIs and GUI.Mind you i did see a successfully synched message on the GUI since i posted this question. enter image description hereenter image description hereenter image description hereenter image description hereenter image description here

Here is the lates synch (GUI)... the command line still shows the same errors as outlined.

enter image description here

  • From my experience, Win Servers must not only be correctly configured to use ntp reliably, they must also know that and trust the source. Therefore, it is better to use the domain controller as timehost. – Posipiet Jan 13 '12 at 10:08
  • @Posipiet The OP said that the server is not a domain member. – MDMarra Jan 21 '12 at 15:47
  • Can you post the full output of w32tm /query /configuration and w32tm /query /status? – rmalayter Jan 31 '12 at 14:55
  • Also w32tm /query /peers – rmalayter Jan 31 '12 at 15:56
  • Do you want this server to be authoritative for your domain? If you want it to be authoritative, it has to sync with its own hardware. If you do NOT want it to be authoritative for a domain (which your PDC should be doing) then you can synchronize it with an outside time server. I also recommend using time.nist.gov or pool.ntp.org. Using the high level names will allow your time to be fault tolerant instead of dependent on one timeserver in a specific region. – JohnThePro Feb 8 '12 at 0:07

It looks like this a VMware VM, and it is set up to synchronize its time with the VMware host using the VMware tools time synchronization mechanism. You should disable that time synchronization option in VMware tools if you want to use NTP to synchronize time instead.

Assuming you have disabled VMware's time sync, run w32tm /monitor /computers:au.pool.ntp.org. If you are having connectivity issues, this will fail with a "no response". Then you need to re-verify the firewall rules.

Note your VMware host should also synchronize it's time using NTP; this can be configured in vCenter or vSphere client. Again you may have to futz with firewalls if you don't have an internal NTP server.

Best practice is to have exactly one or three+ NTP servers "inside" your network (never two). These internal synchronize with external sources (or reference clocks like GPS), and then all other internal machines synchronize to your internal NTP servers. Using Windows domain controllers as these internal NTP servers is common in small networks, but dedicated boxes, routers, firewalls, or UNIX-ish servers are more common in larger networks.

| improve this answer | |
  • The server is a physical server! and i am trying to sync to au.pool.nt.org. the server is in the DMZ so no domain affiliation.now i get C:\w32tm /stripchart /computer:au.pool.ntp.org /samples:10 /dataonly Tracking au.pool.ntp.org []. Collecting 10 samples. The current time is 5/07/2012 9:08:47 AM. 09:08:47, error: 0x800705B4 09:08:50, error: 0x800705B4 09:08:53, error: 0x800705B4 09:08:56, error: 0x800705B4 09:08:59, error: 0x800705B4 09:09:02, error: 0x800705B4 09:09:05, error: 0x800705B4 09:09:08, error: 0x800705B4 09:09:11, error: 0x800705B4 09:09:14, error: 0x800705B4 – Goaks Jul 4 '12 at 23:23
  • Well, that's a connectivity problem. I can reproduce the same on my machine by using a non-existent IP for the /computer parameter. You need to ensure that NTP packets, which use UDP port 123, are allowed outbound on the Windows Firewall, and also allowed outbound to the internet on any firewalls, routers, or other devices between your server and the Internet. – rmalayter Jul 6 '12 at 15:15
  • He has a successful attempt showing on the GUI, (from above) so the Firewall scenario should be OK. – Goaks Jul 24 '12 at 6:53
  • @Goaks: the GUI shows it working for time.nist.gov, but his command lines show he's trying to sync to au.pool.ntp.org. Perhaps his organizational firewalls allow NTP to some well-known NTP servers (although one in the USA is a very bad choice for an Aussie) but not all. – rmalayter Aug 2 '12 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.