Home / server / Questions / 441749
Accepted
Matt
Asked: 2012-10-25 04:09:59 +0800 CST

Setting NTP on Windows 2008 Domain

  • 772

Our Computers are out by a couple of minutes on the network. I have checked the registry on a computer and found that the type is NT5DS which I believe that it is getting the time from our Domain Server. Also in the registry under NtpServer it is stating time.windows.com.

I have searched around and found that w32tm may have something to do with changing the time.

I'm looking for the correct way of changing the time, but keep the NTP internal rather than get the time from an external source. Also my concerns are, will the computers on the network be OK after the time change, as I have heard that if the system is more than 5 mins out of the NTP it can stop things from working.

windows-server-2008

2 Answers

  1. Best Answer

    There is a built-in hierarchy for this already, and you shouldn't change it. The computers will find a domain controller nearest to them for time synchronization based on the site and subnet information defined in Sites and Services. Those domain controllers in turn will synchronize their time with the domain controller that holds the PDC emulator FSMO role. That domain controller holding the role should be configured to use NTP time synchronization against a reliable source be it internal or external, and all the rest of the domain members should fall in line. Typically people will sync against NIST, Microsoft, Apple, or pool.ntp.org. It's also pretty common to have your core switch/router do this and then point all devices needing time sync to that.

    EDIT

    Here is a couple articles referring to doing just this:

    http://technet.microsoft.com/en-us/library/cc786897(v=ws.10).aspx

    http://social.technet.microsoft.com/wiki/contents/articles/8863.time-service-configuration-on-pdc-emulator-fsmo-role-holding-domain-controller-en-us.aspx

    Here's the command to run on your DC that is the PDC emulator:

    w32tm /config /manualpeerlist: peers /syncfromflags:manual /reliable:yes /update

    All you need to do here is configure and sync that PDC emulator DC and everything else joined to AD will start to synchronize and you can call it a day. Attached the image below for your reference (it's in one of the links above). It's also worth noting that this takes care of your Microsoft systems just fine, but if say you had Linux servers or networking devices needing NTP protocol responses you may run into compatibility issue since Microsoft's implementation as an NTP server is shall we say... not so great. Like I mentioned above I will typically point my core router at an external time source, and then point the PDC emulator at that. Everything else in my network needing NTP gets pointed to their local router which is in turn pointed to my core router.

    enter image description here

    • 3

  2. Run DCDIAG on the domain controller and confirm it is advertising as a time server. You may also get the time server advertising status with the NLTEST command: 

    nltest.exe /server:dcname /dsgetdc:acmecorp.com
           DC: \\dcname.acmecorp.com
      Address: \\n.n.n.n
     Dom Guid: 5fb09a11-8148-4d9c-a53a-d7a218880eaf
     Dom Name: acmecorp.com
  Forest Name: acmecorp.com
 Dc Site Name: Blah
Our Site Name: Blah
        Flags: GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS
                              ^^^^^^^^

    You may use the w32tm.exe command on the client to determine why the time sync is not occurring.

    A modern (non-legacy) windows client typically has output similar to below: 

    >w32tm /query /status /verbose
Leap Indicator: 0(no warning)
Stratum: 4 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0937500s
Root Dispersion: 1.0042565s
ReferenceId: 0xDEADBEEF (source IP:  n.n.n.n)  <-- Should be the Domain Controller
Last Successful Sync Time: 10/24/2012 8:25:56 AM
Source: DCName.acmecorp.com <-- Should be the Domain Controller
Poll Interval: 11 (2048s)

Phase Offset: 0.1063193s
ClockRate: 0.0156005s
State Machine: 1 (Hold)
Time Source Flags: 2 (Authenticated )
Server Role: 0 (None)
Last Sync Error: 0 (The command completed successfully.)
Time since Last Good Sync Time: 24.4367708s

    If the DC is not advertising as a time server, but everything seems correct, sometimes manually adjusting the registry value would correct the issue. When a DC is advertising as a time server, the following "Enabled" registry value will be 1. If this is 0, it definitely will not provide time services to your workstations. 

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\NtpServer]
"Enabled"=dword:00000001
    • 0