I am having Time minutes Out of sync of my domain controllers

Question

Dear Community,

I have single domain. And I have 1 domain controller on each site that makes total 5 domain controllers.

Now, my domain controller servers have windows server 2019 installed. The thing is that My Country's Standard Time i.e Pakistan Standard Time is always 2 minutes ahead of time from my domain controllers. Which is really annoying beacause my client machines also gets 2 minute behined because of that. Then I have to manually change the time in domain controller. But that is just temporary. After some time, the domain controllers get 2 minutes behined again. Why is it happening? kindly help me with this issue.

Thanks.

Answer 1

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Some general info

• All domain members should use NT5DS domain time.
• Desktops and member servers sync with any domain controller.
• Domain controllers sync with PDC emulator (one per domain)
• PDC emulator in child domain can sync with any domain controller in parent domain.
• PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.
  https://blogs.technet.microsoft.com/nepapfe/2013/03/01/its-simple-time-configuration-in-active-directory/

on the problematic domain controller (not the PDC emulator) you can

w32tm /unregister
net stop w32time
w32tm /register
net start w32time
w32tm /config /syncfromflags:domhier /update
net stop w32time
net start w32time
then check
w32tm /query /source
w32tm /query /configuration

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Dear DSPatrick,

My Domain Controllers are Virtual machines.

All domain members should use NT5DS domain time.
Answer: Ok but how can I do this Settings?

• Desktops and Member Servers sync with any domain controller.
  Answer: Yes
• Domain controllers sync with PDC emulator (one per domain)
  Answer: Yes I have one domain.
• PDC emulator in child domain can sync with any domain controller in parent domain.
• N/A
• PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.
  Answer: Since the PDC Emulator role is on VM so there is no hardware Clock. So how do I do that through External Source?

Note: I wanted to update you that I tried manually changing the Time from domain Controller but it did not work.

Answer 4

OK. I am attaching the results .

[Configuration]

EventLogFlags: 2 (Local)
AnnounceFlags: 10 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 6 (Local)
MaxPollInterval: 10 (Local)
MaxNegPhaseCorrection: 172800 (Local)
MaxPosPhaseCorrection: 172800 (Local)
MaxAllowedPhaseOffset: 300 (Local)

FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 7 (Local)
UpdateInterval: 100 (Local)

[TimeProviders]

NtpClient (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
CrossSiteSyncFlags: 2 (Local)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Local)
ResolvePeerBackoffMaxTimes: 7 (Local)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 1 (Local)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 1024 (Local)
Type: NT5DS (Local)

NtpServer (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 0 (Local)
AllowNonstandardModeCombinations: 1 (Local)

VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)

Answer 5

The domain controller is using the host for a time source, This should sort it.
https://gist.github.com/gregjhogan/4a83c087af0a54a9a600187b79a39d7f

--please don't forget to upvote and Accept as answer if the reply is helpful--