Our AD domain controller time runs 9/10 minutes fast. How do I resolve the issue?
Note: I looked at several answers/posts, but did not get enlightened.
Details: We have a Hyper-V Server, which hosts our primary and secondary DC (domain controllers).
I did see on several answers that Time Synchronization
in the Integration Services
settings must be unchecked. I complied. I read that following that, the Windows Time
service on the DC must restart. I did that, as well as physically restarted each DC. Still, the same problem.
Here is a screenshot showing the Hyper-V with the setting unchecked.
I read that the NTP registry settings are important. I do not fully understand them, but here they are:
W32Time / Parameters
W32Time / Config
Both DCs have the same settings.
The Hyper-V server has also the same problem with the time being 9/10 minutes fast.
Here are several articles that I looked at: Why is my NTP controlled computer clock two minutes ahead? Domain Controller time is 7 minutes fast Domain time ahead than the real time!
The answer in the first article did not do anything for my problem. The others were explained in a bit too complicated way or did not help.
What is the problem and the resolution?
UPDATE:
PDC (.50/AD1)
C:\>w32tm /query /source
Local CMOS Clock
C:\>w32tm /query /configuration
[Configuration]
EventLogFlags: 2 (Local)
AnnounceFlags: 10 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 6 (Local)
MaxPollInterval: 10 (Local)
MaxNegPhaseCorrection: 172800 (Local)
MaxPosPhaseCorrection: 172800 (Local)
MaxAllowedPhaseOffset: 300 (Local)
FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 7 (Local)
UpdateInterval: 100 (Local)
[TimeProviders]
NtpClient (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
CrossSiteSyncFlags: 2 (Local)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Local)
ResolvePeerBackoffMaxTimes: 7 (Local)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 1 (Local)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (Local)
Type: NT5DS (Local)
NtpServer (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 0 (Local)
AllowNonstandardModeCombinations: 1 (Local)
VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
C:\>
DC (.51/AD2)
Windows PowerShell
Copyright (C) 2014 Microsoft Corporation. All rights reserved.
PS C:\> w32tm /query /source
JMR-AD1.ad.jmr.com
PS C:\> w32tm /query /configuration
[Configuration]
EventLogFlags: 2 (Local)
AnnounceFlags: 10 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 6 (Local)
MaxPollInterval: 10 (Local)
MaxNegPhaseCorrection: 172800 (Local)
MaxPosPhaseCorrection: 172800 (Local)
MaxAllowedPhaseOffset: 300 (Local)
FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 7 (Local)
UpdateInterval: 100 (Local)
[TimeProviders]
NtpClient (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
CrossSiteSyncFlags: 2 (Local)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Local)
ResolvePeerBackoffMaxTimes: 7 (Local)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 1 (Local)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (Local)
Type: NT5DS (Local)
NtpServer (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 0 (Local)
AllowNonstandardModeCombinations: 1 (Local)
VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
PS C:\>
You have no external time source listed for your systems to sync to.
To extend joequerty's answer about setting your PDC-emulator to sync to external clock source, you may wish to use Group Policy to configure it, so that the job of synchronising external time will follow whichever server holds the PDC-emulator role: See the article "Configure NTP Group Policy for PDC DC" here: http://www.cloudyfuture.net/2016/01/26/configure-pdc-emulator-ntp-settings-using-gpo/
(Ignore the article for client GPO)