Network time out by 2mins

[Jaan]

Hi guys just had a support call asking for the time to be adjusted on the client pcs.

 

All clients,servers, hyper-v hosts and dcs all have the same time. But that time is out by about 2 mins.

 

I was going to create a GPO for the DCs but the one in question i'm unable to find. (computers\admin templates\system\windows time).

 

I've been able to determine that the clients are getting their time from either of the two DCs ..... we'll call them dc1 and dc2.

 

DC2 gets its time from dc1...but dc1 gets its time from the "Local CMOS Clock" which i assume is out by two mins.

 

How can i force the dc1 to get its NTP from an external source...... either ntp.pool.org or our UTM which is getting its time from ntp.pool.org as the time is 2mins head!

 

Any pointers would be great. FYI Server 2016 dcs.

 

cheers guys.

[LeMarchand]

I had this recently and used the advice here: Synchronize time with external NTP server on Windows Server 2008 (R2). - Default Reasoning

 

IIRC I had to work down the comments to find the correct syntax. I'm assuming things haven't changed too much since then...

[Jaan]

Ok if it's of any use to people.... i've followed the steps below...... and getting an error 47. So i'm just checking my firewall and will report back.

 

1

Logon to Domain Controller (with PDC role) with Administrator account and open elevated command prompt.

If you have multiple domain controller and don't know which DC holds PDC role then use following command:

netdom /query fsmo

 

2

Type following commands on elevated command prompt

 

3

w32tm /config /manualpeerlist:"0.uk.pool.ntp.org,0x1 1.uk.pool.ntp.org,0x1 2.uk.pool.ntp.org,0x1 3.uk.pool.ntp.org,0x1"

Configure external time sources

 

4

w32tm /config /reliable:yes

Make this DC a reliable time source for the clients.

 

5

net stop w32time && net start w32time

restart w32 time server, now DC should synchronize time with uk.pool.ntp.org time servers.

 

If the DC is not synchronizing time with the external NTP server then check the event logs (Event Viewer >> System). Normally event id 47 which means it is unable to reach the external NTP server, check the firewall to make sure port 123 is open.

 

6

Some helpful w32tm commands:

Force synchronizing the time asap

w32tm /resync /nowait

 

Check NTP configuration

w32tm /query /configuration

 

w32tm /query /source

Display time source

 

w32tm /query /peers

Display list of all configured NTP servers and their status

 

w32tm /query /status

Display time service status i.e whether it is getting time from local cmso clock/external NTP server

 

7

Force domain computers to synchronize the time with the DC; use elevated command prompt

w32tm /config /syncfromflags:domhier /update

net stop w32time && net start w32time

 

8

Following commands will reset the time service to default.

net stop w32time

w32tm /unregister

w32tm /register

net start w32time

[IrritableTech]

You may want to turn off the Time synchronization Integrated Service in your hyper-v VM settings or else your physical machine may try to update your virtual machine which may in turn be the time server for your domain.... it can get conflicty.

[Jaan]

The pdc is physical and bdc is virtual on another box. Both were insync before, just the source was out 2mins.

 

Now i have the correct source time on the PDC and the BDC is looking at the PDC, time sync is enabled in the VM settings for the BDC and i'm getting this:

 

 

Is this because of the time sync in hyper-v? or is it just "catching up?". I had it enabled before and the PDC and BDC were in sync.

 

From what i understand (and i could be wrong). It should be enabled for hyper-v but disabled for other hypervisors:

 

https://serverfault.com/questions/486593/hyper-v-time-sync-for-vm-domain-controller

 

https://blogs.msdn.microsoft.com/virtual_pc_guy/2010/11/19/time-synchronization-in-hyper-v/

[Jaan]

UPDATE: all upto date and synced.

 

port123 was blocked on the firewall.

My PDC was set to local cmos

MY BDC was set to sync to PDC

 

1. Amend Firewall to allow port123

 

2.On PDC as elevated admin set source:

w32tm /config /manualpeerlist:"0.uk.pool.ntp.org,0x1 1.uk.pool.ntp.org,0x1 2.uk.pool.ntp.org,0x1 3.uk.pool.ntp.org,0x1"

 

set as reliable source:

w32tm /config /reliable:yes

 

3. start stop service:

net stop w32time && net start w32time

 

4.on BDC

 

net stop w32time

w32tm /unregister

w32tm /register

net start w32time

 

5.

force bdc to sync to pdc:

w32tm /config /syncfromflags:DOMHIER /update

 

6. start stop the service:

net stop w32time

net start w32time

 

7.

force resync:

 

w32tm /resync /force

 

All upto date, synced and working

[bossman]

@jahilton2002

 

Was going to post, had this happen a couple of weeks ago due to Smoothwall updates, resolved using the same method as you, pleased you sorted, have a good weekend