Time Server / Settings

[Grommit]

Hi

 

How and what is the best way to keep the correct time on the mian DC and have it syncronise with all the other servers and Workstations ?

[webman]

Have the DC sync via NTP to a reliable time source, such as uk.pool.ntp.org.

 

Clients can then use the NET command to set the time from the server, eg.

net time \\dc01 /set /yes

.

[Grommit]

Sorry to be a bit dumb this time of morning.. but how do I sync via NTP ?

 

I see where the net time works on Workstations booting everyday but how do the servers work as they are never booted ?

[Geoff]

You can set time settings in a GPO, or you can use the 'net time /setsntp:uk.pool.ntp.org' command instead.

 

I prefer the GPO method personally, it makes it more obvious what set to what.

[webman]

Hmm. It appears our Windows 2000/2003 servers don't have an Internet Time option in the clock settings dialog. :?

 

As Geoff said, you can set via NTP using the NET command. If you run this as a scheduled task every day on the DC it will keep the time; and then you can set all the clients using your preferred method (again, probably GPO as Geoff suggested) to sync to the DC.

 

Having your clients sync to a local time source is advisable to prevent hundreds of requests going out to the Internet.

[pete]

There is an option in group policy to make the dc set it's time by checking another machine.

 

Computer config > Admin templates > System > Windows Time Service/Time Providers.

 

We modify the default domain controllers policy and set the DCs to act as a ntp client, grabbing time from the proxy server, which syncs with time servers on the Internet, and then they act as the time server for domain computers.

[Grommit]

from what I understand of Geoffs post he only sets the DC to go "outside" to get the correct time and the workstations then have a time check in the logon script "net time \\dcname"

 

Is this correct ?

[Geoff]

That's correct. No point wasting bandwidth when you don't need to.Only thing is, I don't use login scripts on the clients, just separate GPOs for clients and DCs.

[SpuffMonkey]

We use a little freebie gizmo called Winsync

 

http://www.truetime.net/software-winsync.html

 

It does the job and is dead easy to set up

[srochford]

Unless you give users the right to change the system time then doing things like "net time" in the login script won't do anything at all :-)

 

If you check the system event log on your domain controller and filter for events from w32time then you should see what's happening - it's a fairly "quiet" service - basically, it logs when there's a problem and it logs once when things are going OK again so you get a message like:

 

The time service is now synchronizing the system time with the time source tconwl5.cnwl.ac.uk (ntp.d|10.0.0.17:123->10.0.0.5:123).

 

when it's started up.

 

For info, Microsoft seem to be phasing out "net time" in favour of the "w32tm" command which does lots more with a more complex syntax - details on the MS website

[PiqueABoo]

Ughh.. the DC with the PDC role is the default authoritative time-source for a domain. If it's 2K3 I get that syncing with an external NTP source e.g. change "ntp.example.com" to your favourite source and run these commands:

 

w32tm /config /manualpeerlist:ntp.example.com /syncfromflags:MANUAL

net stop w32time

net start w32time

w32tm /resync

 

That's it, job done. You should have a nice informational event log event telling you it worked.

 

Unless you've messed with them, the other DCs will automagically sync with the PDC.

 

Unless you've messed with them, your XP workstations will automagically sync with the DC they picked at startup.

 

Edit: I took this out of the above but it might save you some effort. If the w32tm command doesn't work you might need to substitute the version I need with an extra 0x8 parameter (depends on the remote NTP server):

 

w32tm /config /manualpeerlist:ntp.example.com,0x8 /syncfromflags:MANUAL

[m25man]

2003 DC's do not have an Internet Time Setting option, the tab disappears when you join a domain.

DC's become authorative for time keeping within that domain hence the need to reference an external time source.

 

Global ntp time servers can be used as posted as long as your DC's can ping them!

 

There are still many LEA's and Broadband Consortiums determined to keep every port tightly shut and only permit upstream proxy connections on 80 & 443 so the poor old network will never be able to reach an external time source on port 123.

 

Some grid providers have made sntp provision for local users, Cambridge Schools for instance can use ntp01.cambsed.net hosted by E2BN.

 

Check with your Grid provider for your local ntp server or request that they allow ntp services through the firewall.

[SteveMC]

The most reliable way I've found to configuring the time server on Windows 2003 is to follow Microsoft's KB article at http://support.microsoft.com/kb/816042 - the second section is the one to use .

One thing to be aware of is that the RM SEGfL seems to block access to external time servers. The SEGfL ones to use are ntp.segfl.ifl.net and ntp.ifl.net (the second one is probably available to any of the Internet for Learning networks).

 

Even with it all configured, the RM time servers aren't the most reliable in the world, so you'll still see warnings in the event logs from time to time, but on the whole it all works nicely.