Windows time service source does not change to DC from "Local CMOS Clock"

Question

Hello,

I'm experience an issue with Windows Time service on selected domain joined workstations.

All workstations are configured to sync time from Domain controllers - NT5DS

However selected group of devices which physically located in the same network segment showing CMOS clock as main time source.

Unregister W32tm service and re-configure with "w32tm /config /syncfromflags:DOMHIER /update" does not take any affect.

We also do not have any policies for these settings which might interfere.

Looking at W32time service logs I have these alert:

W32TimeHandler called: SERVICE_CONTROL_INTERROGATE

So it looks like device cannot get proper time source peer list from DC.

This was already tested without local Firewall

Does anybody encountered with similar problems ?

Many thanks in advance!

Answer 1

I'd check that the domain controller and problem member both have the static ip address of DC listed for DNS and no others such as router or public DNS, also check that both got the domain network firewall profile.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hello Aleksandr,

Thank you for posting in Q&A forum.

Based on the description, I understand the issue occurs on some of the workstations.

Please check:

1.If these workstations with the issue are physical machine or virtual machines. If they/some of the problematic workstations are virtual machines, we may need to disable Time Synchronization on Virtual platform.

2.We need to check if port 123 is open. on these problematic workstations. The Windows Time service follows the Network Time Protocol (NTP) specification, which requires the use of UDP port 123 for all time synchronization. Whenever the computer synchronizes its clock or provides time to another computer, it happens over UDP port 123.

3.On one problematic workstation, check the following registry values.

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type

Key Name: Type

Type: REG_SZ(String Value)

Data: NT5DS

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config

Key Name: AnnounceFlags

Type: REG_DWORD (DWORD Value )

Data: 0xa

4.Check other AD ports that should open on both DC and workstation.

Active Directory and Active Directory Domain Services Port Requirements

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd772723(v=ws.10)?redirectedfrom=MSDN

Active Directory Replication over Firewalls

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/bb727063(v=technet.10)?redirectedfrom=MSDN

Hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

==========================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 3

Hello Daisy,

I can confirm required registries are in place.

Configuration itself looks ok on affected machines:

After enabling verbose logging for time service I can see that it looks like client cannot get peer list so it cannot open socket to DC from where it can sync time.

I also tested with disabled local Firewall so ports definitely not a problem here: