NTP Time service on Domain Controller is using the wrong Reg key

Question

NTP Time service on Domain Controller is using the wrong Reg key

Namless Shelter 241

Hi

I just found out our DC01 server (a virtual server 2012 R2 box),

under Regedit:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\Parameters -

NTPserver key is actually pointing to one of the old IP which does not exist any more.....

I don't know why or who set it up like this.

How can I rectify this situation? Does it mean this whole time DC01's time service is pointing to nothing....What value should this key hold? Can I safely change it to a different value like time.windows.net?

Thanks
ML

5 answers

Your answer

Answer 1

Anonymous

Some general info

All domain members should use NT5DS domain time.
Desktops and member servers sync with any domain controller.
Domain controllers sync with PDC emulator (one per domain)
PDC emulator in child domain can sync with any domain controller in parent domain.
PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.
https://blogs.technet.microsoft.com/nepapfe/2013/03/01/its-simple-time-configuration-in-active-directory/

On the PDC emulator

w32tm /unregister
net stop w32time
w32tm /register
net start w32time
w32tm /config /manualpeerlist:<ntp ip address> /syncfromflags:manual /reliable:yes /update
net stop w32time
net start w32time
then check the results
w32tm /query /source
w32tm /query /configuration

--please don't forget to upvote and Accept as answer if the reply is helpful--

Namless Shelter 241 Reputation points

2021-12-13T22:07:05.52+00:00

Hi Thanks for that.

The DC server is actually a virtual machine. I know if we run Time service on a VMware virtual machine, it will generate some stability issues. So we run NTP on an authoritative server on another physical server 2016 box. So, my question now is can I modify this regedit key on DC server: NTPserver key to this physical Authoritative server's IP? Don't really want to run this w32 tm to a Time service provider....

Thanks
ML

Answer 2

Anonymous

Usually, the time source is a hardware clock or an internet time source. Whatever is being used; use the ip address in the commands I posted above. Manual registry editing is very much error prone and too complex to discuss in forums. Better to start a case with microsoft product support for that. W32tm is a much cleaner / simpler method.
https://learn.microsoft.com/en-us/archive/blogs/nepapfe/its-simple-time-configuration-in-active-directory

--please don't forget to upvote and Accept as answer if the reply is helpful--

Namless Shelter 241 Reputation points

2021-12-14T00:04:42.7+00:00

Actually I found this article: https://learn.microsoft.com/en-us/services-hub/health/remediation-steps-ad/configure-the-root-pdc-with-an-authoritative-time-source-and-avoid-widespread-time-skew

Looks like I can try:

Modify the NtpServer value to contain the NTP server to synchronize time with followed by 0x8, for example 131.107.13.100,0x8. Multiple NTP servers must be space-delimited, for example 131.107.13.100,0x8 24.56.178.140,0x8

Open an administrative Command prompt and execute the following command: w32tm /config /update

Can I do this safely?

ML

Answer 3

Anonymous

Sure, you can try anything you like. The issue is not knowing what is lingering. Better option is to delete / recreate the service as I've shown above.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Namless Shelter 241 Reputation points

2021-12-14T01:38:52.89+00:00

Also, I know once NTP server is not synced correctly, domain joined machine will not be able to log in. Once NTP is sync correctly again, clients windows log in will be fine again, it is not like we have to re-imaged all the clients machines... am I correct?

Answer 4

Anonymous

No worries, it does not work like that.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/configure-w32ime-against-huge-time-offset

domain members are unaware of differences between the PDC emulator and its configured time source. If the time is off by a large delta then you could manually correct it in small increments beforehand.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Anonymous

2021-12-14T19:31:21.03+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--
Namless Shelter 241 Reputation points

2021-12-14T22:25:31.05+00:00

It should be all good as long as the whole thing can be fixed manually. I was worrying too much about machine cannot be logged in etc..
Anonymous

2021-12-14T22:42:26.92+00:00

was worrying too much about machine cannot be logged in etc..

Not an issue here. The domain members / member servers all subscribe to any domain controller, domain controllers subscribe to PDC emulator. So regardless of the time on PDCe the rest will follow. If the delta currently is a high value then you can make incremental adjustments until its under 5 mins.

--please don't forget to upvote and Accept as answer if the reply is helpful--
Anonymous

2021-12-15T12:38:58.437+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 5

Limitless Technology 39,931

Hello @Namless Shelter

Yes, in this case, the machine may have been receiving NTP sync from the Host through Hyper-V Integration Services, but it is recommended you configure an authoritative time server for your domain:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/configure-authoritative-time-server

Hope this helps with your query,

----------

--If the reply is helpful, please Upvote and Accept as answer--

Share via

NTP Time service on Domain Controller is using the wrong Reg key

5 answers

Your answer