2

From the MS Documentation I can see that computers in a domain should get their time from the PDC domain controller, and if done right the PDC should get it's time from an external source.

In my environment I have changed the PDC a while back after upgrading a domain level. I still have the old PDC but it is no longer listed as the PDC if I run netdom /query fsmo. All domain controllers show the right PDC (and other FSMO roles).

On my current PDC I have updated the time to sync from an external time source as per a few articles from MS (most this one). However the PDC is saying that it is still getting it's time from the old PDC when I run w32tm /query /status

The old PDC is saying that it is getting it's time from a hardware CMOS clock and updating it seems to make no difference to this value.

Every once in a while the time will go out on our network by about 10 - 12 minutes causing all sorts of havoc, as you could imagine.

Does anyone know how to get the time setup properly on a domain?

8

From the MS Documentation I can see that computers in a domain should get their time from the PDC domain controller

Not an accurate statement. Domain members need not sync time with the PDCe directly. They may sync with any domain controller in the domain, if they are configured to use "domhier"/"NT5DS"/"domain hierarchy." Ideally, they will sync with a domain controller in their local site, using the same DC Locator process as they use when they originally logged on to the domain.

and if done right the PDC should get it's time from an external source

Yes, as long as it's the forest root PDCe and not a child domain PDCe.

windows time

On my current PDC I have updated the time to sync from an external time source as per a few articles from MS (most this one). However the PDC is saying that it is still getting it's time from the old PDC when I run w32tm /query /status

Use gpresult /h rsop.htm to verify that you do not have Group Policies applying to the domain controllers that are overriding your manual config. If you do then you must remove the policies.

If not, then let me know exactly what command you used to manually configure your PDCe.

The old PDC is saying that it is getting it's time from a hardware CMOS clock and updating it seems to make no difference to this value.

On the former PDCe, just reset everything:

net stop w32time
w32tm /unregister
w32tm /register
net start w32time

This is of course after you've verified that there are no GPOs overriding your time settings. Then use w32tm /stripchart /computer:YourNewPDCe to verify that you actually have network connectivity over UDP port 123 and can contact that server with NTP.

What do the event logs say?

If the servers are virtual machines, use the VM integration tools to disable time sync with the host VM. (And/Or disable VMICTimeProvider via the Windows registry - HKLM\System\CCS\Services\W32time\Timeproviders\)

  • You are a legend. I did have some GPOs that were playing around. I can now see the my PDC is syncing to external source and the other DC's are syncing to PDC. – tyelford Mar 21 '16 at 2:13
  • @tyelford Glad to help. :) – Ryan Ries Mar 21 '16 at 2:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.