+ Post New Thread
Results 1 to 11 of 11
Windows Thread, Time on a domain in Technical; I do realise that time is vitally important on a domain for Kerberos tickets, but I always thought it sort ...
  1. #1

    Join Date
    Jul 2006
    Location
    London
    Posts
    2,962
    Thank Post
    159
    Thanked 152 Times in 116 Posts
    Rep Power
    49

    Time on a domain

    I do realise that time is vitally important on a domain for Kerberos tickets, but I always thought it sort of configured itself.

    However for the last few days Ive been having quite a lot of event log errors and warnings on my DC's. They have been in place since christmas and this is the first ive seen of the errors.

    First one, that appears pretty much throughout the day is:

    Code:
    Event Source:	W32Time
    
    Description:
    The time provider NtpServer encountered an error while digitally signing the  NTP response.  NtpServer cannot provide secure (signed) time to the client and will ignore the request. The error was: The specified user does not exist. (0x80070525)
    From what I've read on the net this comes from a machine trying to synchronize time but isnt joined to the domain properly or something

    The other error I get (this is more rare, happened 3 times this week)

    Code:
    Event Source:	Kerberos
    Event ID:	4
    
    Description:
    The kerberos client received a KRB_AP_ERR_MODIFIED error from the server DT-E7-04$.  The target name used was cifs/LT-SIXTH-13.xxx.local. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named  machine accounts in the target realm (xxx.LOCAL), and the client realm.   Please contact your system administrator.
    Now this just completely confuses me. Why does that client think it is a time server?
    Every time this happens it seems to be 2 totally different machines, unrelated to each other.

    Now how do you set up time properly? Ive synched my DC's to the LEA time server, but its only the PDC emulator thats responsible for time isnt it?

    Also, how do I configure clients? Currently they are just pointing to time.windows.com. Should they point to the PDCE? And should this set through DHCP?

  2. #2

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Time on a domain

    For the first one, turn on the debugging.

    http://support.microsoft.com/default...;en-us;M816043

    For the second one, try running netdiag on the client machine and see if that reveals any problems.

  3. #3

    Join Date
    Jul 2006
    Location
    London
    Posts
    2,962
    Thank Post
    159
    Thanked 152 Times in 116 Posts
    Rep Power
    49

    Re: Time on a domain

    Thanks, cannot get debugging to work though
    Ive followed the instructions to the letter, including location of log file, but there have been a few events logged and no sign of any file appearing yet

  4. #4

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Time on a domain

    You might have to wait a while. Time synchronisation occurs sparingly.

  5. #5

    Join Date
    Jul 2006
    Location
    London
    Posts
    2,962
    Thank Post
    159
    Thanked 152 Times in 116 Posts
    Rep Power
    49

    Re: Time on a domain

    Still nothing, yet there has been 13 w32time events logged since yesterday
    Id wager that it isnt working
    Wonder why

  6. #6

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Time on a domain

    You can specify client/server Time settings in GPOs if required.

  7. #7

    Join Date
    Jul 2006
    Location
    London
    Posts
    2,962
    Thank Post
    159
    Thanked 152 Times in 116 Posts
    Rep Power
    49

    Re: Time on a domain

    very weird, there hasnt been a single error this morning or all weekend
    maybe it is a client pc causing it

    Geoff whats the 'correct' way to set up time settings, servers etc? When I say correct, I mean how do you do it?
    Or should it be the sort of thing that should look after itself unless you get any problems

  8. #8

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Time on a domain

    You can be lazy and just run this on each of your DCs:

    Code:
    net time /setsntp:ntp.yourisp.co.uk
    However once you start to have a few it can get annoying. Your better off having a GPO that sets the time settings for DCs.

    On clients (including member servers), the defaults should just 'work'. ie, the machines will sync to your DC(s) clock(s). You can manually specify the situation with GPOs or on the command line of course.

    If your DCs have wrong/different clocks or timezone settings, hilarity will ensue.

  9. #9
    apeo's Avatar
    Join Date
    Sep 2005
    Location
    Lost
    Posts
    1,612
    Thank Post
    95
    Thanked 115 Times in 111 Posts
    Rep Power
    42

    Re: Time on a domain

    Ive been have a time problem for a while now.. some unknown reason i cant sync with our lea and im still waiting for them to get back to me. Is there anything that i need to check on my end?

  10. #10
    ICTNUT's Avatar
    Join Date
    Jul 2005
    Location
    Hereford
    Posts
    1,419
    Thank Post
    196
    Thanked 249 Times in 122 Posts
    Rep Power
    62

    Re: Time on a domain

    If you have a firewall check that port 123 (TCp & UDP) and is open, this is the port that ntp sends and receives requests on. If this is blocked you have no cahnce of syncing with the lea.

  11. #11
    apeo's Avatar
    Join Date
    Sep 2005
    Location
    Lost
    Posts
    1,612
    Thank Post
    95
    Thanked 115 Times in 111 Posts
    Rep Power
    42

    Re: Time on a domain

    Best i can tell it wont be blocked on our end.

SHARE:
+ Post New Thread

Similar Threads

  1. VBS File takes long time to load 1st time?
    By Samson in forum Scripts
    Replies: 3
    Last Post: 4th September 2007, 07:40 AM
  2. Replies: 3
    Last Post: 10th April 2007, 08:40 AM
  3. Who works term time only? How many full time?
    By gwendes in forum General Chat
    Replies: 45
    Last Post: 10th February 2007, 05:38 PM
  4. 1 Domain + 1 domain + syncronised users = possible?
    By tarquel in forum Wireless Networks
    Replies: 52
    Last Post: 30th October 2006, 02:08 PM
  5. Synchronizing time on a domain
    By woody in forum Windows
    Replies: 8
    Last Post: 13th September 2005, 01:36 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •