Time Source for PDC and connected servers / workstations ?

Question

Time Source for PDC and connected servers / workstations ?

TonyJK 881

Hi,

We observe that workstations connected to Domain Controller in a remote site out of sync from the DC there.

When we attempt to run w32tm /resync, some workstations get reply like "The computer did not resync because no time data was available" and some others failed to sync.

Then we find that the Domain Controller some workstations connected to (i.e. authenticated) is different from the Time Source (Some of them points to Local / Another Domain Controller or even 169.x.y.z).

We would like to seek you advice

How do we find out the NTP server being used by the PDC ?
How do we find out the Time Source used by other Domain Controllers ?
Does the Time Source for workstations / servers connected to DC should use that particular DC as Time Source ?
How do we set up so that workstations / servers to use the DC it is connected to OR to a single source PDC ?

My manager asks whether the setting is in Group Policy ?

Thanks

Accepted answer

4 additional answers

Your answer

Answer 1

Anonymous

Some general info

All domain members should use NT5DS domain time.
Desktops and member servers sync with any domain controller.
Domain controllers sync with PDC emulator (one per domain)
PDC emulator in child domain can sync with any domain controller in parent domain.
PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.
https://blogs.technet.microsoft.com/nepapfe/2013/03/01/its-simple-time-configuration-in-active-directory/

--please don't forget to upvote and Accept as answer if the reply is helpful--

TonyJK 881 Reputation points

2022-02-13T02:32:20.677+00:00
Dear Dave,

Many thanks for your advice. I have followed the article and set up NTP for PDC.

We would like to implement GPO for other DC and Member Servers & workstations.

May I ask

Should we set up NTP Client in Default Domain Policy as PDC has to be excluded ?

When we enable NTP Client, we need to use NT5DS as type. What should be used for NTP Server - Leave it blank OR Name of the PDC (Like: PDC.company.com,0x9 OR an external NTP Source ?

Thanks again.

Answer 2

Anonymous

other DC's, member servers, and workstations all default to using NT5DS time, otherwise you can

w32tm /unregister
net stop w32time
w32tm /register
net start w32time
w32tm /config /syncfromflags:domhier /update
net stop w32time
net start w32time
then check
w32tm /query /source
w32tm /query /configuration

--please don't forget to upvote and Accept as answer if the reply is helpful--

TonyJK 881 Reputation points

2022-02-13T02:50:57.783+00:00

Dear Dave,

May I ask why we need to run
net stop w32time

as w32tm has already been unregistered in the first row ?

Thanks
TonyJK 881 Reputation points

2022-02-13T11:03:54.387+00:00

Dear Dave,

Instead of running the script, is there anyway to make sure that other DCs, member servers and workstations use NT5DS time ?

Thanks
Anonymous

2022-02-13T14:44:38.757+00:00

It happens by default when joining domain. You can check it by

w32tm /query /configuration

--please don't forget to upvote and Accept as answer if the reply is helpful--
TonyJK 881 Reputation points

2022-02-14T03:29:33.97+00:00
Dear Dave,

I have followed your advice.

I find that

NTP = Domain Controller that machine is connected to

Type = NTP (Not NT5DS)

Do I need to change the NTP ? How to change the Type for NTP to NT5DS for all connected servers / workstations ?

C:\Windows\system32>w32tm /query /configuration
[Configuration]

EventLogFlags: 2 (Local)
AnnounceFlags: 5 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 6 (Local)
MaxPollInterval: 10 (Local)
MaxNegPhaseCorrection: 4294967295 (Local)
MaxPosPhaseCorrection: 4294967295 (Local)
MaxAllowedPhaseOffset: 300 (Local)

FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 1 (Local)
UpdateInterval: 100 (Local)

[TimeProviders]

NtpClient (Local)
DllName: C:\Windows\SYSTEM32\w32time.DLL (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Local)
ResolvePeerBackoffMaxTimes: 7 (Local)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 1 (Local)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (Local)
Type: NTP (Local)
NtpServer: DCR003 (Local)

VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
NtpServer (Local)
DllName: C:\Windows\SYSTEM32\w32time.DLL (Local)
Enabled: 0 (Local)
InputProvider: 0 (Local)

C:\Windows\system32>

Answer 3

Anonymous

w32tm /unregister (marks service for deletion)
net stop w32time (completes the process in case it was running)

--please don't forget to upvote and Accept as answer if the reply is helpful--

Anonymous

2022-02-13T14:16:59.693+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

Anonymous

How to change the Type for NTP to NT5DS for all connected servers / workstations

You could create a policy that applies to the OU for the computers that sets NT5DS

Anonymous

2022-02-14T13:38:44.63+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--
TonyJK 881 Reputation points

2022-02-15T21:12:29.89+00:00

Dear Dave,

May I ask whether I can leave NtpServer empty after changing type to NT5DS ?

Thanks
Anonymous

2022-02-15T21:19:45.03+00:00

Yes, we can. When we set NT5DS then the others are simply ignored.

Answer 5

Hasan Emre SATILMIŞ 1

Hi TonyJK-1323,

You can check the link below.

https://hasanemresatilmis.com/2017/03/08/active-directory-saat-senkronizasyonu-ntp-configuration/

Best Regards.

Share via

Time Source for PDC and connected servers / workstations ?

4 additional answers

Your answer