Unable to time-sync with Domain Controller

Question

Unable to time-sync with Domain Controller

Mark Foley 141

I've recently un-joined a Windows 10 workstations from one AD domain and joined it to a new domain. I've used the ForensiT Profwiz to migrate the user profile. My problem is that when I checked the time sync using 'w32tm /query /source' it came back with time.windows.com, not my DC. This workstations did previous show connected to the previous DC. In an effort to reset the time souce I did:

net stop w32time
w32tm /unregister
w32tm /register
net start w32time

After that, the /query /source gave me 'Local CMOS Clock'. Nothing I have tried since changes this source. I also tried:

w32tm /config /manualpeerlist:dc1,0x8 /syncfromflags:MANUAL
w32tm /config /update

but that had no effoect. I also tried deleting the "Time Sources" GPO because a) someone said I didn't need a GPO and b) I though I'd try setting the Date & Time setting manually, but even after deleting the GPO and rebooting the workstations and the DC it still says, "Some of these settings are hidden or managed by your organization".

So, how to I reset the time sync to source from the Domain Controller? Is there some registry settings I have to tweak?

6 answers

Your answer

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 2

Thameur-BOURBITA 36,261 Moderator

Hi @Mark Foley

If the machine is member of domain , the type should be NTDS5 and not NTP when you run the following command.

w32tm /query /configuration

Is this already the case?

Please don't forget to accept helpful answer

Mark Foley 141 Reputation points

2024-01-07T17:45:22.4966667+00:00

Here's my w32tm /query /configuration:

EventLogFlags: 2 (Local)

AnnounceFlags: 10 (Local)

TimeJumpAuditOffset: 28800 (Local)

MinPollInterval: 10 (Local)

MaxPollInterval: 15 (Local)

MaxNegPhaseCorrection: 4294967295 (Local)

MaxPosPhaseCorrection: 4294967295 (Local)

MaxAllowedPhaseOffset: 300 (Local)

FrequencyCorrectRate: 4 (Local)

PollAdjustFactor: 5 (Local)

LargePhaseOffset: 50000000 (Local)

SpikeWatchPeriod: 900 (Local)

LocalClockDispersion: 10 (Local)

HoldPeriod: 5 (Local)

PhaseCorrectRate: 1 (Local)

UpdateInterval: 30000 (Local)

[TimeProviders]

NtpClient (Local)

DllName: C:\WINDOWS\SYSTEM32\w32time.DLL (Local)

Enabled: 1 (Local)

InputProvider: 1 (Local)

AllowNonstandardModeCombinations: 1 (Local)

ResolvePeerBackoffMinutes: 15 (Local)

ResolvePeerBackoffMaxTimes: 7 (Local)

CompatibilityFlags: 2147483648 (Local)

EventLogFlags: 1 (Local)

LargeSampleSkew: 3 (Local)

SpecialPollInterval: 3600 (Local)

Type: NTP (Local)

NtpServer: dc1,0x8 (Local)

VMICTimeProvider (Local)

DllName: C:\WINDOWS\System32\vmictimeprovider.dll (Local)

Enabled: 1 (Local)

InputProvider: 1 (Local)

NtpServer (Local)

DllName: C:\WINDOWS\SYSTEM32\w32time.DLL (Local)

Enabled: 0 (Local)

InputProvider: 0 (Local)

As you can see, the type is NTP, not NTDS5. How do I fix this?
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-07T18:07:46.3533333+00:00

@Mark Foley

Check if there is any GPO settings to force NTP instead of NTDS5 on member machine: Computer Configuration\Administrative Templates\System\Windows Time Service\Time Providers\Configure Windows NTP Client.

You can switch from NTP to NTDS5 through registry key Type under Ordinateur\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters :

Try to modify this registry on one of impacted machine then restart W32tm service.

Please don't forget to accept helpful answer
Mark Foley 141 Reputation points

2024-01-07T22:11:27.89+00:00

I changed the registry as advised and rebooted. w32tm /query /configuration then gave "The following error occurred: The service has not been started." I then ran 'net start w32time', but got:

The Windows Time service is starting.

The Windows Time service could not be started.

I then went to Services and started 'Windows Time', but got "The Windows Time service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs."

So, what next?
Mark Foley 141 Reputation points

2024-01-08T05:11:34.2466667+00:00

Based on other solutions I tried 'scf /scannow', and tried setting the service from 'Automatic ' to 'Automatic'. I also tried:

1. Right click on the Start button, click on Run, type "Services.msc” in the box, and then press ENTER,
2. Locate and double click the Windows Time service. - I think for Windows Any service with 1079 error-
3. Click the Log On tab,
4. In the This account text box, type “NT AUTHORITY\LocalService”,
5. Set both Password fields blank,
6. Click Apply and then OK,

This seemed to take OK, but trying to start the service again came back with the error, ""The Windows Time service on Local Computer started and then stopped. ..."

So far, I'm dead in the water getting the time service to work.
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-08T08:53:20.4366667+00:00

@Mark Foley

Did you try to run
w32tm /unregister
w32tm /register
and check if you still have NTP error ?

Please don't forget to accept helpful answer
Mark Foley 141 Reputation points

2024-01-08T16:58:22.97+00:00

Thameur-BOURBITA: Thanks for that suggestion. I was able to start the time service after doing that. Although I did the unregister/register at the beginning of this epic, I hesitated to try that again as that's what resulted in "Local CMOS Clock" being the time source.

Now that the time service is running, I am back to the beginning with "Local CMOS Clock" reported in 'w32tm /query /source'. The registry is showing Type NT5DS, and 'w32tm /query /configuration' shows Type: NT5DS (Local).

So - I still need to get the time source being my DC. When I run this query on my current production domain I get 'mail.hprs.local', not "Local CMOS Clock. Note that, per advice, I've deleted the Time Source Group Policy.

Again, how to fix?
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-08T17:42:56.4133333+00:00

@Mark Foley

Is mail.hprs.local a domain controller ?

If it's not the case may be it's forced through GPO , you can generate a go report through this command : gpresult /H c:\temp\hpresult.html

You can check on registry key (NTPServer) and remove it.

Try to restart W32tm service after each action.

Please don't forget to accept helpful answer
Mark Foley 141 Reputation points

2024-01-08T18:28:04.5433333+00:00

mail.hprs.local is the old/current domain controller. I am migrating workstations from that to the new domain with DC dc1.hprs.locl. With the old domain I did/do have a GPO for the time. Based on other advice, I removed that GPO from the new domain because someone said it was not needed and the Windows domain members would "figure it out". Therefore, gpresult shows nothing for Time Sources, as expected. Per your suggestion, I did delete the key NTPServer. I rebooted. I still get "Local CMOS Clock" as the source. Should I try recreating the GPO?
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-08T18:41:18.0866667+00:00

@Mark Foley •

I think we are close to find a solution for this problem :)

Did you check if the NTP port is opened between domain controllers and member machine ?

Network port

Please don't forget to accept helpful answer
Mark Foley 141 Reputation points

2024-01-08T20:15:09.9033333+00:00

Ah ha! Ports 123 and 1023 are open on the server. Let me see if I can figure out how to check for those ports on the member. I'll be back ...
Mark Foley 141 Reputation points

2024-01-09T03:18:21.2066667+00:00

After setting up a UDP listener on the DC I was able to connect to it and send text from a Linux host on the LAN using 'ncat' and also from our problem child domain member using 'ncat' (nmap-7.94-setup.exe). Specifically: 'ncat -u 192.168.1.60 123'. Both of those clients were able to send text to the DC which has ntp listening on udp port 123.

So, there is no firewall or other blockage between the Windows domain member and the DC.

Is the domain member's Time service trying to communicate with dc1 (192.168.1.60) on port 123? What else can we check?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Aleksandr Shilov 0 Reputation points

2024-01-09T11:51:53.13+00:00

Try this:

w32tm /config /syncfromflags:domhier /update

w32tm /resync /rediscover
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-09T15:05:02.72+00:00

@Mark Foley •

You can run another time w32tm /unregister then w32tm /register , try to rejoin the machine. and if it's not working you should run network capture in order to understand NTP traffic from impacted client.

Please don't forget to accept helpful answer
Mark Foley 141 Reputation points

2024-01-09T16:45:12.97+00:00

I probably should have tried Aleksandr's proposal first. when I did the w32tm /unregister and w32tm /register I got "The following error occurred: The specified service has been marked for deletion. (0x80070430)", but there was no service listed "following".

Alexsandr, in the past I have used

w32tm /config /manualpeerlist:dc1,0x8 /syncfromflags:MANUAL

However, I tried your commands. The config gave "The command completed successfully", but the resync gave, "The computer did not resync because no time data was available". Maybe the unregister messed this up?

I'll next try rejoining the member to the domain.
Anonymous

2024-01-10T06:02:42.5933333+00:00

Hello Mark Foley,

Thank you for posting in Q&A forum.

1.You can configure the time sync via Group Policy or Registry (not both).

===other DC & Client===

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type

Key Name: Type

Type: REG_SZ(String Value)

Data: NT5DS

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config

Key Name: AnnounceFlags

Type: REG_DWORD (DWORD Value )

Data: 0xa

2.Meanwhile, please check time sync issue occurs on one domain machine or all the domain machines.

If the issue occurs on all domain machines, we may need to check Domain Controller (such as port on DC).

3.Whether your domain machine is virtual machine? If so, you may need to disable the time sync on virtual platform.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Mark Foley 141 Reputation points

2024-01-12T17:11:59.06+00:00

I tried 'w32tm /config /syncfromflags:DOMHIER /update', but that didn't help. In addition, my HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config has disappeared entirely. I'm going to image restore this computer to before joining the domain and start over. I'll post back results.
Mark Foley 141 Reputation points

2024-01-16T18:55:30.97+00:00

I don't know what happened to all the other comments and answers in this thread! After all the tips and advice failed to resolve the problem, I image-restored my Windows computer back to before I joined the domain. I verified that connected to the old domain the w32tm /query /source was "mail.hprs.local". I unjoined that domain an joined to the new domain: hprs.locl. After rebooting and logging in as the domain admin, and without doing anything, the /source was time.windows.com,0x9 whereas I expected (hoped) it would be dc1.hprs.locl. I then used RegistryFinder 2.58.1 to change all occurances of mail.hprs.local to dc1.hprs.locl, and all other occurance of hprs.local to hprs.locl in the Registry for the domain admin. That seemed to work as the Redirected Desktop and other things then showed up. However, the time source is now "Local CMOS Clock". When I checked the HKLM/SYSTEM\CurrentControlSet\Services\W32Time\Config, Type it was set to AllSync. I changed that to NT5DS and rebooted, but source is still "Local CMOS Clock". I have no time source GPO set up. After joining the domain, my time source was never the DC and was time.windows.com. Changing the domain name is the registry possibly affected this and set it to "Local CMOS Clock". Now, what should I try first to get this to be dc1.hprs.locl? I've made an image backup of this computer just after joining the domain, so if I get hopelessly messed up I can restore back to that point. Thanks.
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-16T19:18:36.4666667+00:00

@Mark Foley Did you try to install new operating system from scratch and try to join it to new domain if it able to set one od domain controller as NTP server ? If you still have the issue , you scan contact Microsoft support and open a ticket for this case: https://serviceshub.microsoft.com/support/create

Please don't forget to accept helpful answer and close this thread
Mark Foley 141 Reputation points

2024-01-16T23:31:48.9+00:00

I don't really have an available system to try a scratch install of Windows. And in any case, even if that worked, I don't think I want to scratch install all the office workstations, and reinstall all apps, etc. This problem may have to do with changing the domain name from hprs.local to hprs.locl. Most advisors on this project say one should not do that, but they also say that one shouldn't use .local as part of the domain name, so I thought I'd take advantage of the upgrade to change the domain name. If all else fails, I may wipe he DC and reinstall using the old domain name. Since my last post I've gone ahead and added a "Time Sources" GPO and rebooted the DC and domain member. Unfortunately, no change, still "Local CMOS Clock". So, are there some Registry settings I can brute-force and manually set the time source to something? This info must be kept somewhere, but my search in the Registry has turned up nothing. I cannot change the source in the Date & Time settings because it says, "Some of these settings are hidden or managed by your organization", which is proving to be false in my case!
Mark Foley 141 Reputation points

2024-01-17T16:46:06.2233333+00:00
I image-restored the computer back to its previous state. w32tm /query /source gave "time.windows.com", not "Local CMOS Clock". Based on another suggestion, I did the following, in powershell:

stop-service w32time w32tm /unregister w32tm /register start-service w32time w32tm /config /manualpeerlist:0.pool.ntp.org /syncfromflags:manual /update w32tm /config /reliable:yes restart-service w32time w32tm /resync w32tm /query /source

I image-restored the computer back to its previous state. w32tm /query /source gave "time.windows.com", not "Local CMOS Clock". Based on another suggestion, I did the following, in powershell: stop-service w32time w32tm /unregister w32tm /register start-service w32time w32tm /config /manualpeerlist:0.pool.ntp.org /syncfromflags:manual /update w32tm /config /reliable:yes restart-service w32time w32tm /resync w32tm /query /source The /resync came back with "the computer did not resync because no time data was available." So, this must be some problem in the Windows computer as the DC is not being specified as the time source. If this thread has no more suggestions, I'll try one more thing, the I'll post a ticket to the support hub, although we have no service contract, so it might not work.
Thameur-BOURBITA 36,261 Reputation points Moderator

2024-01-17T18:01:50.4433333+00:00

@Mark Foley Did you try running w32tm /unregister
w32tm /register and check the NTP type => NTDS5 to be synced from a domain controller ?
Mark Foley 141 Reputation points

2024-01-27T18:44:33.2433333+00:00

I started completely over. Thinking perhaps I messed up the domain member registry by changing the domain/realm, I re-created the DC with the old name mail.hprs.local, wiped and image restored the domain member back to its pre-unjoined state, unjoined from the old DC and joined to the new DC. Unfortunately, I still have the time sync issue. Things I've tried on the newly joined domain member: net stop w32time
w32tm /unregister
w32tm /register
net start w32time

net stop w32time
w32tm /unregister
w32tm /register
w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL
net start w32time
w32tm /config /update >w32tm /config /syncfromflags:domhier /update The command completed successfully.
>w32tm /resync /rediscover Sending resync command to local computer The computer did not resync because no time data was available. [powershell]
stop-service w32time
w32tm /unregister
w32tm /register
start-service w32time
w32tm /config /manualpeerlist:0.pool.ntp.org /syncfromflags:manual /update
w32tm /config /reliable:yes
restart-service w32time
w32tm /resync
w32tm /query /source
The above /resync gave, "The computer did not resync because no time data was available." HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters/Type = "NTP". The Time Sources GPO > Computer Configuration > Policies > Administrative Templates > System > Windows Time Service > Time Providers, > ‘Configure Windows NTP Client’, has FDQN = "mail.hprs.local,0x8", Type = NT5DS. w32tm /query /configuration gives "NT5DS (Policy)" as the Type.
Sorry for this long thread, but nothing I do seems to fix this time issue. Is there anything else I can try? Perhaps I need to call Microsoft Support at this point?

Answer 3

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 4

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 5

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

Unable to time-sync with Domain Controller

6 answers

Your answer