Time server shenanigans

[mrbios]

I'm in the process of replacing my 2008R2 DCs with 2012R2 ones and nearly finished, but one aspect is bugging me and that's the time server side of things.

 

As far as I was previously aware, i thought (this was setup many years ago and i have no prior knowledge, and typcially no one made documentation on it...) that my FSMO role server was the authoritive time server for the domain and spoke to an outside time server source, but doing some investigating now that I'm replacing the server I'm coming to the conclusion that may not be the case.

 

I've got two DCs, DC1 has FSMO roles and i thought was setup to talk to uk.pool.ntp.org, looking at the registry keys though the Parameter of "Type" was still set to NT5DS, so presumably my two domain controllers have never talked to an outside server even though the ntp server setting was set to uk.pool.ntp.org,0x1. Only one server has the "AnnounceFlags" key set to 5, the others are all set to 10, is that correct?

 

Basically I've no idea how to setup the time server for my network and i need help this appears to be helpful: https://nchrissos.wordpress.com/2013/04/26/configuring-time-on-windows-2008-r2-servers/ for explainging what everything does, but not exactly how it works.

 

If i setup just my main DC with the following settings would this be the correct and more foolproof method:

Under Parameters....

NtpServer: uk.pool.ntp.org,0x1

Type: NTP (Default NT5DS)

 

Under Config...

AnnounceFlags: 5 (Default 10)

MaxAllowedPhaseOffset: 1 (Default 300)

 

Under NtpClient...

SpecialPollInterval: 900 (Default appears to be 3600)

 

Under NtpServer...

Enabled: 1

 

Is there anything else i should be changing? And do i need to worry about "disabling" the old time source or will everything automatically switchover the day that old server is demoted and shutdown?

 

EDIT: also looking at this: https://support.microsoft.com/en-us/kb/816042 and now wondering if my AnnounceFlags should be set to "0xA" instead of "0x5" I've really no idea what the announceflags means >_< ?

Edited August 19, 2015 by mrbios

[rrrrr]

I have just done this on my network

I had an issue caused by our DC's being virtual.

The issue was "DC Was trusted time source on network" > "Physical host server updated time from DC" > "physical host updated DC time through integration services" > Loop

 

this loop was causing a few seconds to get lost in the process, causing our clocks to get further and further out of sync as time went on.

Below is a quick diagram of my setup now

[Davit2005]

We have 2 Virtual DC's and one physical, currently all FSMO roles on one of the Virtual's.

 

I was advised by VMWare trainer to have separate NTP server and to move FSMO ROLES/PDC emulator out of Virtual environment.

 

Last time we had a Powercut and had no UPS ( long story) our Virtual DC's time went back over 6 months which caused AD Sync problems which we managed to fix but didn't find for a few days.

 

I think the below command is what I set on PDC emulator which Domain PC's look at for Time by default.

 

w32tm /config /syncfromflags:manual /manualpeerlist:0.uk.pool.ntp.org,1.uk.pool.ntp.org,2.uk.pool.ntp.org,3.uk.pool.ntp.org,0x1 /reliable:yes /update

[howartp]

That command that Davit posted is what we use on all our domain PCs and servers, except they all point to our Smoothwall, as do the ESX servers and anything else that's wondering what time it is.

 

The Smoothwall then points to UK.pool.something.or.other.

[rrrrr]

It depends on if your dc is virtual or not. If your dc is physical then it can be set to update from an external source (utm or uk.pool,ntp.org) and be the reliable source for all your network clients using the command davit mentioned,

If your dc is virtual, you need to split this command as i mentioned in my previous post, as a virtual dc will only update from the host server, you cannot set it to any other source. It will just revert back

[howartp]

If your dc is virtual, you need to split this command as i mentioned in my previous post, as a virtual dc will only update from the host server, you cannot set it to any other source. It will just revert back

Unless you disable this option in VMware tools. Mine are all disabled, so I can use one source for NTP.

[rrrrr]

Unless you disable this option in VMware tools. Mine are all disabled, so I can use one source for NTP.

 

In hyper-v, even if you disable time synchronisation on the integration services, the vm dc update source will just change from host to bios (which is same thing) if you try and set it to another source it wont change from this.

 

I havent tried vmware as we are a hyper-v environment, but in davits comment, vmware recommend not using a virtualised ntp server as it caused him issues

[howartp]

Fair enough - I'm equally not familiar with hyper-v.

 

I have done my VMware vsphere course last year and we discussed DCs there; it has previously been advised not to virtualise PDC etc, but there's no longer any reason not to.

 

Note I'm not using virtualised ntp server, just virtualised ntp clients.