I believe I'm having an issue with my Domain Controllers and Time Server. On my back up DC, I keep seeing a warning stating "The time service has stopped advertising as a time source because the local clock is not synchronized."

Does this mean that my backup DC believes it's a Time Server? My PDC should be the time server and I have gone through setting up the PDC as the time server.

I was not around for the original setup of the time server with the old PDC and Backup DC. But I believe the old PDC was the time server so I setup the new PDC as the new time server, when I decommissioned the old PDC. Is it possible that the Backup DC was setup as the time server and it still thinks it's suppose to be giving out time to everyone?

Registry for PDC has NTP Registry for Backup has NT5D5

Results of w32tm /monitor

Getting AD DC list for default domain...
Analyzing:delayoffset from DC1.local..com
Stratum: 4
delayoffset from DC1.local..com
Stratum: 3

Reverse name resolution is best effort. It may not be
correct since RefID field in time packets differs across 
NTP implementations and may not be using IP addresses.

ICMP: 1ms 
NTP: -0.6349491s         RefID: DC1.local..com []

DC1.local..com *** PDC ***[]:
ICMP: 0ms 
NTP: +0.0000000s         RefID: wwwco1test12.microsoft.com []
  • 1
    If it's active directory, there really shouldn't be a distinction between DC's as backup or primary. They're peered except for certain roles. – Bart Silverstrim Apr 5 '12 at 16:25
  • 3
    @BartSilverstrim While there is no PDC as in NT days, there is for the purposes of time synchronization in AD. The PDC Emulator FSMO Role is responsible for finding an external time source and all the other DCs sync with it. – Chris S Apr 5 '12 at 16:56

Ok, first to clear a few things up: There are no PDCs and BDC unless you're in an NT4 domain. If this is the case, skip the rest of my answer, you're on your own there. In Windows 2000 AD and later, there are multi-master peers. One of the multi-master (FSMO) roles is PDC Emulator. The word Emulator is important, as it is not a PDC. It is simply a peered Domain Controller that performs some additional functions that used to be performed exclusively by a PDC.

One of those functions is providing time services to other DCs and to member servers. The way that a Windows Domain handles time sync is as follows:

Windows Clients -----> Logon Server -----> DC with the PDC Emulator role

What this means is that some clients will sync their time directly with the DC holding the PDC Emulator role, but only if that DC is their logon server. You can check this by inspecting the %logonserver% environmental variable on a domain member.

If you run w32tm /monitor you should be able to see all Domain Controllers in your AD. The lower the stratum, the better. Your PDC Emulator should have the lowest stratum of the bunch, normally 4 or 5.

As you can see, ALL DCs act as time sources in the domain. All DCs sync their time from the PDC Emulator. As such, if a non-PDC Emulator is set to sync its time from an external source (which I think may be your actual issue), you want to reset this to sync from the domain hierarchy. To do this, run w32tm /config /syncfromflags:DOMHIER /Update then stop and start the Windows Time Service and run w32tm /resync.

Before you do any of this, make sure that the server holding the PDC Emulator role is configured to sync from a reliable external source or has a good internal clock. It's usually best to sync if from an external source.

tl;dr; - Sounds like your config is a bit screwed up. All DCs offer time service. Make sure your PDC Emulator syncs from a reliable source. Then make sure that all other DCs and domain members sync from the default domain hierarchy.

  • So there is no longer PDC, even though all the roles reside on one DC? Is "Role PDC Owner", the PDC Emulator that you are talking about? – poconnor Apr 5 '12 at 16:56
  • I added the results of the w32tm /monitor to my post. – poconnor Apr 5 '12 at 17:19
  • Yes, that's what PDC Role Owner means. Your update makes it look like your second DC is not advertising itself as a reliable time source. Have you checked the time config on that and reset it if needed to sync from the domain hierarchy? – MDMarra Apr 5 '12 at 17:47
  • I was going to wait until after work hours to try and do the sync reset. I will let you know what happens. – poconnor Apr 5 '12 at 19:22
  • I ran that command, and I noticed that there was a warning saying that it stopped advertising, another saying that it was off by so much, then about 2 minutes later it was corrected and it started advertising correctly. Is this normal? – poconnor Apr 6 '12 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.