6

Our Active Directory server has a problem whereby the time keeps setting itself 12 minutes ahead of the real time. This causes authentication issues on the network.

I have tried syncing to an external NTP service with the following:

w32tm /config /manualpeerlist:pool.ntp.org /syncfromflags:MANUAL
stop-service w32time
start-service w32time

Then tried to set the time 12 minutes back. But within seconds it skipped 12 minutes ahead again.

I tried to unregister the service using:

w32tm /unregister

Then tried setting the time correctly but again it reverted to the incorrect setting.

Is there some way I can set the time without it changing itself?

12
  • 4
    Is it a Virtual server?
    – vembutech
    Dec 18, 2014 at 20:43
  • 4
    NTP is pretty infallible. I highly recommend keeping it on, especially on an AD server. Turning it off will lead to even more auth issues. What are you basing "real time" on?
    – Arthur
    Dec 18, 2014 at 20:56
  • 1
    whtas the result of w32tm /query /source and what virtualization do you use? Dec 19, 2014 at 14:04
  • 2
    @Hyppy If by "now", you mean since about 15 years ago, then yes. Windows does support NTP "now". :) Dec 19, 2014 at 14:41
  • 3
    You all had me questioning my sanity, but after re-researching I found that indeed Windows' W32Time implementation of NTP is a bit... off. It's really SNTP half-baked into an NTP lookalike. For example, it's only accurate to ~3+ seconds, and doesn't implement error checking/filtering correctly enough for real NTP peers to maintain an association. MS specifically suggests using third-party tools for time sensitive clock keeping or for time synchronization not specific to Kerberos. support.microsoft.com/kb/939322
    – Hyppy
    Dec 19, 2014 at 18:01

2 Answers 2

1

First off pool.ntp.org is not a reccomended source for the Windows Time Service. See here: Active Directory Time Synchronisation - Time-Service Event ID 50

I am confused by your comment that this one server is off, but all the other ones are accurate, but you are using pool.ntp.org. In an Active Directory environment, the PDCe is the "root" time server that every other domain controller syncs against (and every member server and workstation syncs against the domain controllers). The PDCe should be configured to sync with an external time source via NTP. The PDCe should be the only server that syncs with an external source.

See here: http://blogs.technet.com/b/nepapfe/archive/2013/03/01/it-s-simple-time-configuration-in-active-directory.aspx

Note that if you are in an Active Directory environment, and everything is syncing from the PDCe as it should, then VMs should not be configured to sync their time with the physical host. If you have two things trying to correct the clock, they will fight each other.

2
  • 2
    To clarify: Domain Controllers will sync with the PDCe. All other members will sync with their authenticating DC.
    – joeqwerty
    Jan 5, 2015 at 16:49
  • @joequerty Yeah that didn't come through too clearly in my original answer. Fixed. Thank you. Jan 5, 2015 at 18:57
0

I've had a similar issue. I think my time was about 5 minutes out... I tried all the usual w32time commands / restarted services and it wouldn't adjust... No Joy!!

What I did in the end was purposefully set the time to something obscure e.g. a few months ahead or behind re-ran the w32time commands and hey presto it came back within a good tolerance (a few milliseconds).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.