Server 2008 Clients not getting Group Policy because of time issues

[talksr]

Really not sure what is going on here,

 

If I manually run gpupdate /force on any of our Windows 10 clients, I get the following:

Microsoft Windows [Version 10.0.10586]
(c) 2015 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>gpupdate /force
Updating policy...

Computer policy could not be updated successfully. The following errors were encountered:

Windows was unable to determine whether new Group Policy settings defined by a network administrator should be enforced for this user or computer because this computer's clock is not synchronized with the clock of one of the domain controllers for the domain. Because of this issue, this computer system may not be in compliance with the network administrator's requirements, and users of this system may not be able to use some functionality on the network. Windows will periodically attempt to retry this operation, and it is possible that either this system or the domain controller will correct the time settings without intervention by an administrator, so the problem will be corrected.

If this issue persists for more than an hour, checking the local system's clock settings to ensure they are accurate and are synchronized with the clocks on the network's domain controllers is one way to resolve this problem. A network administrator may be required to resolve the issue if correcting the local time settings does not address the problem.
User Policy update has completed successfully.

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.

 

I have opened an administrator cmd and tried both w32tm /resync and w32tm /resync /force, but all I get is the following:

C:\WINDOWS\system32>w32tm /resync

Sending resync command to local computer

The computer did not resync because the required time change was too big.

The above group policy update response would suggest that the time is being set via Group Policy, but I am struggling to find it configured in any of our policies. The majority of computers, do appear to be displaying the correct time, yet they are giving the above response.

 

Does anyone have any ideas?

[Steve21]

There's a maximum figure the timeservers/clients will allow NTP to sync by set in the registry, if it's bigger than that it'll refuse to sync back in time.

 

How far out are the times?

 

Steve

[TwistedHelixis]

Do your servers have the correct time?

[Oaktech]

can you run the command

 

w32tm /query /status

 

on your workstation and your servers and post the results back.

[Steve21]

Would also do

 

w32tm /query /peers

 

while you're doing that

 

Steve

[talksr]

Ah, time is well off on server. It thinks it is the correct time but on Saturday 12th November. Not sure how this happened as it was correct last week. I have changed it and ran w32tm on a couple of stations followed by gpupdate /force and it looks as though we are back on track. Will continue to check and will update on here the result.

[Steve21]

Is your server set to sync up from an external NTP source? Should keep that in line too

 

Steve

[Michael]

In a domain environment, once one of your servers is configured as a time server (from a real external source), all clients will look to your server at every reboot automatically.

 

It's the server you need to sort out, then your clients will follow. If they're out by 5 mins you'll get lots of lovely errors.

[talksr]

Does anyone know where on Server 2008 I can check if it is syncing with an external NTP source?

We should be using the lgfl one: time.lgfl.org.uk

[Steve21]

w32tm /query /peers

 

 

Steve

[talksr]

w32tm /query /peers

 

 

Steve

 

Thanks, very useful. It currently has none assigned, so curious that it just changed two days ahead out of nowhere?!

[mistersparky]

Assuming this is a VM, is the VM itself set to sync time with the host? You can find the options for this here:

 

In general, I've always avoided this and stuck with the built-in time functionality within Windows. However, it would still be highly advisable to configure the ESXi hosts to sync to a valid time source (if you are not doing so already), to avoid issues such as this, maintain accurate log times, etc.

[Davit2005]

The DC holding the PDC emulator role would normally give out the time within a Domain. In the past I have simply setup the PDC emulator to look at external NTP servers and this has worked every time. You may not be able to do this if the firewall/LEA provided internet connection blocks it though.

 

Their is a setting that you can specify that allows you to adjust this. I have had to do this at a previous place on our Citrix VDI desktops as after a Daylight time change they would not pick up the policies.

 

As far as VMWare hosts go I would make sure these are also configured to look at a suitable time source because even if you disable the VM looking at the time on the host it still may well pick up the time from the host.

Edited November 11, 2016 by Davit2005