AD Time Sync?

[Garacesh]

It was my understanding that when joined to a domain, Windows clients should actively look for a Domain Controller and synchronise time accordingly. To coin Apple's phrase it should "just work".

 

Alas, this is not the case with Windows 10. And I ain't got the foggiest on how to fix this.

 

Following this Microsoft article on the subject has yielded no results.

 

Computer Configuration\Policies\Administration Templates\System\Windows Time Service\Enable Windows NTP Client is Enabled

Computer Configuration\Policies\Administration Templates\System\Windows Time Service\Configure Windows NTP Client is set as:

NtpServer: DomainController.domain.local

CrossSiteSyncFlags: 2

ResolvePeerBackoffMinutes: 15

ResolvePeerBackOffMaxTimes: 7

SpecialPollInterval: 3600

EventLogFlags: 0

But the W10 machines aren't syncing up time. Granted they're only a minute or two out from each other but this still isn't ideal compared to how it works for Windows 7, but looking at our 7 policies I can't find anything mentioning NTP, which ties up with my idea that it "just works" when connected to a domain.

 

Anybody else grappled this issue?

[DJ-1701]

Odd, sorry to say I haven't had this issue, Windows 10 synced fine with the domain time for me.

[DJ-1701]

Out of interest... your time server isn't on a VM is it?

[dapaulio]

never had a problem

 

- are your clients configured with the correct time server and can you ping your ntp server

- the group policy that specifies your time server has not got a WMI filter excluding your windows 10 clients

 

to verify your time server

 w32tm /query /peers [/Code]

[theeggmaster]

Could a firewall on the clients be blocking the NTP port?

[Garacesh]

Windows Firewall isn't blocking it (disabled on all network machines, since we have an edge firewall)

 

My test machine is currently under strict

rules as I'm testing screen timeout policies, but I shall text the w32tm peers once I'm done.

[Michael]

Windows 10 should behave like previous OSes (at least in my experience), promoting your PDC to a real time server outside.

 

As others have stated however, an aggressive firewall would/could block NTP port 123.

[Garacesh]

 w32tm /query /peers [/Code]

 @dapaulio, I ran that and got:
 
[code]C:\User\%USERNAME>w32tm /query /peers
#Peers: 1

Peer: DomainController.domain.local
State: Active
Time Remaining: 695.2351060s
Mode: 3 (Client)
Stratum: 1 (primary reference - syncd by radio clock)
PeerPool Interval: 17 (out of valid range)
HostPoll Interval: 10 (1024s)

[dhicks]

As others have stated however, an aggressive firewall would/could block NTP port 123.

 

If it's any help, we're currently finding that our Lightspeed filter is blocking NTP traffic on port 123 as it sees it as "peer to peer" traffic. This is possibly because it uses UDP rather than TCP. On our system Lightspeed is filtering outside connections only, so it's just stopping our Domain Controller contacting the time service, interal clocks are at least syncrhonised, if possibly a few seconds off from GMT. A different firewall and/or configuration to ours might well see internal NTP (or, indeed, all UDP) traffic being blocked.

[dapaulio]

run on the affected machine

 

W32TM /query /status /verbose

 

look up last sync time then then go look any "system" event logs around that time that may help you relating to time-service

Edited June 6, 2016 by dapaulio

[Garacesh]

W32TM /query /status /verbose

 

Leap Indicator: 0(no warning)
Stratum: 2 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0312500s
Root Dispersion: 16.0100000s
RefereceId: 0x0A72C015 (source IP: IP.OF.DOMAIN.CONTROLLER)
Last Successful Sync Time: 06/06/2016 15:39:25
Source: DomainController.domain.local
Poll Interval: 10 (1024s)

Phase Offset: 0.3973089s
ClockRate: 0.0156252s
State Machine: 1 (Hold)
Time Source Flags: 0 (None)
Server Role: 0 (None)
Last Sync Error: 0 (The command completed successfully.)
Time since Last Good Sync Time: 21.9368093s

 

Incidentally, time is now synchronised.

[dapaulio]

Leap Indicator: 0(no warning)
[color="#FF0000"]Stratum: 2 (secondary reference - syncd by (S)NTP)[/color]
Precision: -6 (15.625ms per tick)
Root Delay: 0.0312500s
Root Dispersion: 16.0100000s
RefereceId: 0x0A72C015 (source IP: IP.OF.DOMAIN.CONTROLLER)
Last Successful Sync Time: 06/06/2016 15:39:25
Source: DomainController.domain.local
Poll Interval: 10 (1024s)

Phase Offset: 0.3973089s
ClockRate: 0.0156252s
State Machine: 1 (Hold)
Time Source Flags: 0 (None)
Server Role: 0 (None)
Last Sync Error: 0 (The command completed successfully.)
Time since Last Good Sync Time: 21.9368093s

 

Incidentally, time is now synchronised.

 

Look at you stratum in the first. although your dc is configured as your time server your w10 computer appeared to look towards a reference time clock outside your network (stratum 1 - radio clock). whatever has happened between then and now it would appear now it is referencing your DC for a time (stratum 2 - (S)NTP). maybe your dc was not able to reply to the request at the time and moved onto a failsafe peer. who knows, im not exactly an expert in this area but i would start asking the question why is it not contacting my DC each time. there maybe underlying issues.

[Garacesh]

Yes, I did notice the difference, though I can't explain it. Nothing has changed between now and then besides bouncing the machine a few times. I'll reimage it tomorrow and try to replicate the issue.

[dapaulio]

Good luck. Doesn't sound much of an issue if it is losing sync by 1 minute. Granted not ideal and it would probably bug me too but I think it only starts becoming a network issue if the time starts losing sync by several minutes

 

Maybe put a ping dc -t on overnight see if you have any ping drops

[Garacesh]

Okay, here's a spanner in the works for you..

 

If I find a computer that's out of sync, and login, time syncs. If I then log off, it desyncs.

 

For example, the computer sat next to me (test machine set up to be a pupil computer in one of the rooms that are using Windows 10) has its clock approximately 25 seconds behind my computer (which is sync'd with AD)

If I log in as a pupil user, time is synchronised to the second. If I then sign out and the clock becomes 2 seconds slow. If I reboot, the difference increases to 13 seconds. Log in as a 'member of staff', time is synchronised

 

So it appears that the clock on the lock screen is not synchronising with the domain controller until somebody logs in. I have no idea where it's getting its time from otherwise. I would have assumed BIOS, but given that I've observed a delay of both 25 and 13 seconds, I'm not sure about that, either.

 

Like I've said, a 60s difference isn't a massive issue. But if time drifts too much, Kerberos will start to rejecting. And that would be bad.

 

Edit: If I let the machine idle and lock, about a second is lost.

Edit2: Rebooted again a while later and it went back to -25s. Maybe it is using BIOS time?

Edit3: Nope. BIOS time is only .5s behind network time

Edited June 7, 2016 by Garacesh

[dapaulio]

try switching debug on

 

w32tm /debug /enabled /file:c:\w32tm.log (just check the syntax) hopefully this may give more info as to what is going on

 

on the affected machine can you look at the system event logs also. you will see loads of Time-Service events. do they all report

The time provider NtpClient is currently receiving valid time data from ... [/Quote]

 

if you type w32tm /resync then w32tm /status /verbose and repeat several times is the stratum result consistent each time you perform the resync?

 

I am guessing that it is syncing with a number of peers externally as well as internally based on who is available at the time.

try setting the /manualpeerslist:""

Have you checked log on/off startup/shutdown scripts for any time syncing cmds which may cause you this headache.

 

i think it is safe to say this is not normal situation as my computer is windows 10 and the sync is accurate all the time

[Garacesh]

w32tm /resync
Sending resync command to local computer
The command completed successfully.

Every time I run resync then query the stratum is 2

 

If I reboot the machine (so the logon screen clock is out by 3 seconds now) and run w32tm /query /computer:windows-10-test /status it still pulls back Stratum 2 despite time being out.

 

However!

If I run /query against a computer in the ICT room (which are having the same time issues) I get:

Leap Indicator: 3(last minute has 61 seconds)
Stratum 0 (Unspecified)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0312500s
Root Dispersion: 11.0898400s
ReferenceId: 0x00000000 (unspecified)
Last Successful Sync Time: 07/06/2016 10:07:59
Source: DomainController.domain.local
Poll Interval: 10 (1024s)

 

Querying the same machine 2 minutes later gives me Leap Indicator of 0 and a Stratum of 2 with a proper ReferenceId just like my test machine that is synchronised with AD.

 

All this leads to me to believe that the Windows Time service isn't actually running until somebody logs in (and policy says "oi, sync with time service" which presumably starts the service) or until I actively query it (which again, would start the service.. Maybe..)

If I check this against other machines and it shows the Windows Time service is set to Manual start.

Use Group Policy to set the service to Automatic start, reboot the machine and...

 

-18 seconds

And it's still saying Stratum 2

Edited June 7, 2016 by Garacesh

[dapaulio]

did you try enabling debug as i suggested above to see if if gave you any more information as to what it is doing? and check your scripts you have running during log on and log off

 

judging from what you are saying the time is not drifting out but it is like they are syncing with another time source. are the affected computers consistently losing time by a certain number of seconds (which in my opinion it is syncing with another peer when it cant contact your dc)

 

or is it completely random between computers.

 

can you tell im clutching at straws now

[Garacesh]

There seems to be no uniformity of how much time is lost. It's anywhere between 10 and 30 seconds out, depending on reboots etc. I can investigate more on the machines in the ICT suite after 3 o'clock when they're free.

 

The only startup script we have here is a ROBOCOPY script (on all machines) to pull across mandatory profiles and start menu layout to the local machine as W10 seems to prefer using local resources rather than network ones, and DELPROF2 (on pupil machines) to clear off user profiles to avoid excessive buildup of user, user.domain, user.domain.000, user.domain.001 ad infinitum.

 

My test machine is currently at -11s.

I have run w32tm /register on the domain controller, just to be certain.

 

 

w32tm /query /computer:windows-10-test /source /verbose

DomainController.domain.local,0x8

 

w32tm /query /computer:windows-10-test /configuration /verbose

[Configuration]

EventLogFlags: 2 (Local)

AnnounceFlags: 10 (Local)

TimeJumpAuditOffset: 28800 (Local)

MinPollInterval: 10 (Local)

MaxPollInterval: 15 (Local)

MaxNegPhaseCorrection: 4294967295 (Local)

MaxPosPhaseCorrection: 4294967295 (Local)

MaxAllowedPhaseOffset: 300 (Local)

 

FrequencyCorrectRate: 4 (Local)

PollAdjustFactor: 5 (Local)

LargePhaseOffset: 50000000 (Local)

SpikeWatchPeriod: 900 (Local)

LocalClockDispersion: 10 (Local)

HoldPeriod: 5 (Local)

PhaseCorrectRate: 1 (Local)

UpdateInterval: 30000 (Local)

 

FileLogName: (Undefined or NotUsed)

FileLogEntries: (Undefined or NotUsed)

FileLogSize: 0 (Undefined or NotUsed)

FileLogFlags: 0 (Undefined or NotUsed)

 

[TimeProviders]

NtpClient (Local)

DllName: C:\windows\system32\w32time.dll (Local)

Enabled: 1 (Local)

InputProvider: 1 (Local)

CrossSiteSyncFlags: 0 (Undefined or NotUsed)

AllowNonstandardModeCombinations: 1 (Local)

ResolvePeerBackoffMinutes: 15 (Policy)

ResolvePeerBackoffMaxTimes: 7 (Policy)

CompatibilityFlags: 2147483648 (Local)

EventLogFlags: 0 (Policy)

LargeSampleSkew: 3 (Local)

SpecialPollInterval: 3600 (Policy)

Type: NTP (Policy)

NtpServer: DomainController.domain.local,0x8 (Policy)

 

NtpServer (Local)

DllName: C:\windows\system32\w32time.dll (Local)

Enabled: 0 (Local)

InputProvider: 0 (Local)

 

w32tm /query /computer:windows-10-test /peers /verbose

#Peers: 1

 

Peer: DomainController.domain.local,0x8

State: Active

Time Remaining: 637.4862273s

Mode: 3 (Client)

Stratum: 1 (primary reference - syncd by radio clock)

PeerPoll Interval: 17 (out of valid range)

HostPoll Interval: 10 (1024s)

Last Successful Sync Time: 07/06/2016 14:45:21

LastSyncError: 0x00000000 (Succeeded)

LastSyncErrorMsgId: 0x00000000 (Succeeded)

AuthTypeMsgId: 0x0000005A (NoAuth )

Resolve Attempts: 0

ValidDataCounter: 1

Reachability: 3

 

w32tm /query /computer:windows-10-test /status /verbose

Leap Indicator: 0(no warning)

Stratum: 2 (secondary reference - syncd by (S)NTP)

Precision: -6 (15.625ms per tick)

Root Delay: 0.0312500s

Root Dispersion: 16.0100000s

ReferenceId: 0x0A72C015 (source IP: IP.OF.DOMAIN.CONTROLLER)

Last Successful Sync Time: 07/06/2016 14:45:36

Source: DomainController.domain.local,0x8

Poll Interval: 10 (1024s)

 

Phase Offset: -0.1259657s

ClockRate: 0.0156250s

State Machine: 1 (Hold)

Time Source Flags: 0 (None)

Server Role: 0 (None)

Last Sync Error: 0 (The command completed successfully.)

Time since Last Good Sync Time: 475.5785469s

 

If I login to my test machine as the local administrator account, system time is synchronised with network time.

 

w32tm /debug /enable /file:C:\w32tm.txt /entries:999 /size:4096

Reboot machine (Clock is now -8s)

Login as 'member of staff' (Clock is now perfectly synchronised to the second)

Log out (Clock is now -3s)

151733 13:58:16.7707129s - ---------- Log File Opened -----------------
151733 13:58:59.1346553s - ---------- Log File Opened -----------------
151733 13:59:09.1716411s - Association: (Local) 0.0.0.0:123 => IP.OF.DOMAIN.CONTROLLER:123 (Remote)
151733 13:59:10.6747034s - Association: (Local) 0.0.0.0:123 => IP.OF.DOMAIN.CONTROLLER:123 (Remote)

 

I have no idea if any of this will be useful but I'm tearing my hair out here. It synchronises perfectly when any user logs in, including non-domain users, but it's not synchronised on the lock screen.

Edited June 7, 2016 by Garacesh

[dapaulio]

useful log file

 

Im afraid i am just as much at a loss as you now.

 

how old are the computers? have you tried replacing the CMOS battery in a couple computers. i originally eliminated this as a cause as i didnt see it likely all your w10 computers had cmos battery issues

Have you got any windows 7 computers? how are they at keeping sync?

[Garacesh]

Windows 7 keep tune without issue - but then again, there's no clock on the login screen. If you login to W7 the clock syncs. If you login to W10 the clock syncs.

[Garacesh]

Whelp, I've tried adding multiple DC's to the peer list, including using only a physical DC so no VM stuff might get in the way..

 

If I fire up the machine and run "Net Time \\Windows-10-Test" I get the correct network time even when the clock on the lock screen is wrong.

 

All of this I find leading me to only one logical conclusion: The lock screen clock must notbe dependent on, nor controlled by, the W32Time service. I don't know what the hell is powering it but every angle I query time from gets me the correct time, but the clock on the lock screen is always out.

 

If I change the computer's location in Time and Date settings, both net time and the system clock after logging in display the correct (network synchronised) time, just with the GMT +/- modifier. This does not cause an issue with Kerberos.

 

So basically, I might as well just find a way to hide the clock from the lock screen. It would be nice to keep, but if it's going to vary from machine to machine, that's just annoying.

[dapaulio]

Nic power saving?

[Garacesh]

Nic power saving?

 

Was enabled, but I've disabled it through GPO (reg update) and still the clock is out.

 

No matter how much I google around I can't find anything to do with the clocks being out of sync, not matching up, or anything of the sort

 

Edit: WAIT! Hang on.. It's syncing now!

Edit2: Rebooted, unsyncd

Edited June 9, 2016 by Garacesh

[dapaulio]

Lol bet someone is toying with you sending remote commands to random computers.

 

Sounds like a prank I could do to my junior techy. He is going to have a bad day tomorrow 😂

 

I imagine you can't find anything because it not supposed to happen. It's definately an anomaly.

 

My pc is windows 10 and has always kept sync which means something is interfering and doing something that it shouldn't.

 

I hope you get it sorted. Make sure you reply if you do as I am as curious as you are