1

Our Computers are out by a couple of minutes on the network. I have checked the registry on a computer and found that the type is NT5DS which I believe that it is getting the time from our Domain Server. Also in the registry under NtpServer it is stating time.windows.com.

I have searched around and found that w32tm may have something to do with changing the time.

I'm looking for the correct way of changing the time, but keep the NTP internal rather than get the time from an external source. Also my concerns are, will the computers on the network be OK after the time change, as I have heard that if the system is more than 5 mins out of the NTP it can stop things from working.

Improve this question
3

There is a built-in hierarchy for this already, and you shouldn't change it. The computers will find a domain controller nearest to them for time synchronization based on the site and subnet information defined in Sites and Services. Those domain controllers in turn will synchronize their time with the domain controller that holds the PDC emulator FSMO role. That domain controller holding the role should be configured to use NTP time synchronization against a reliable source be it internal or external, and all the rest of the domain members should fall in line. Typically people will sync against NIST, Microsoft, Apple, or pool.ntp.org. It's also pretty common to have your core switch/router do this and then point all devices needing time sync to that.

EDIT

Here is a couple articles referring to doing just this:

http://technet.microsoft.com/en-us/library/cc786897(v=ws.10).aspx

http://social.technet.microsoft.com/wiki/contents/articles/8863.time-service-configuration-on-pdc-emulator-fsmo-role-holding-domain-controller-en-us.aspx

Here's the command to run on your DC that is the PDC emulator:

w32tm /config /manualpeerlist: peers /syncfromflags:manual /reliable:yes /update

All you need to do here is configure and sync that PDC emulator DC and everything else joined to AD will start to synchronize and you can call it a day. Attached the image below for your reference (it's in one of the links above). It's also worth noting that this takes care of your Microsoft systems just fine, but if say you had Linux servers or networking devices needing NTP protocol responses you may run into compatibility issue since Microsoft's implementation as an NTP server is shall we say... not so great. Like I mentioned above I will typically point my core router at an external time source, and then point the PDC emulator at that. Everything else in my network needing NTP gets pointed to their local router which is in turn pointed to my core router.

enter image description here

Improve this answer
3
  • Thank you for the information. How would you go about changing the time when the time is wrong?
    – Matt
    Oct 24 '12 at 12:42
  • You can just set the time manually if you want to, but there will always be drift. You should be using NTP to sync the PDC emulator to a reliable source.
    – SpacemanSpiff
    Oct 24 '12 at 12:52
  • Once you set an external time source on the server at the top of the pyramid, its clock will either jump to or converge on the correct time. Then all the other computers in the network will automatically follow suit.
    – longneck
    Oct 24 '12 at 13:02
0

Run DCDIAG on the domain controller and confirm it is advertising as a time server. You may also get the time server advertising status with the NLTEST command: 

nltest.exe /server:dcname /dsgetdc:acmecorp.com
           DC: \\dcname.acmecorp.com
      Address: \\n.n.n.n
     Dom Guid: 5fb09a11-8148-4d9c-a53a-d7a218880eaf
     Dom Name: acmecorp.com
  Forest Name: acmecorp.com
 Dc Site Name: Blah
Our Site Name: Blah
        Flags: GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS
                              ^^^^^^^^

You may use the w32tm.exe command on the client to determine why the time sync is not occurring.

A modern (non-legacy) windows client typically has output similar to below: 

>w32tm /query /status /verbose
Leap Indicator: 0(no warning)
Stratum: 4 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0937500s
Root Dispersion: 1.0042565s
ReferenceId: 0xDEADBEEF (source IP:  n.n.n.n)  <-- Should be the Domain Controller
Last Successful Sync Time: 10/24/2012 8:25:56 AM
Source: DCName.acmecorp.com <-- Should be the Domain Controller
Poll Interval: 11 (2048s)

Phase Offset: 0.1063193s
ClockRate: 0.0156005s
State Machine: 1 (Hold)
Time Source Flags: 2 (Authenticated )
Server Role: 0 (None)
Last Sync Error: 0 (The command completed successfully.)
Time since Last Good Sync Time: 24.4367708s

If the DC is not advertising as a time server, but everything seems correct, sometimes manually adjusting the registry value would correct the issue. When a DC is advertising as a time server, the following "Enabled" registry value will be 1. If this is 0, it definitely will not provide time services to your workstations. 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\NtpServer]
"Enabled"=dword:00000001
Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.