smarties11 Posted May 3, 2018 Posted May 3, 2018 Hi All, I'm battling to try and get our first DC that holds the PDC Emulator role to sync time with an external time server. It has worked for several years and then stopped working a few months back. As an interim measure, I installed NetTime on the DC and let that control the clock instead. However, what I didn't realise was that although the DC was keeping correct time, because it wasn't being set by the w32time service, other servers and clients in our domain have stopped trusting it as a source so have reverted to using the local CMOS clock. This became apparent yesterday when our users were being asked for credentials to access the Internet, which turned out to be because the time on our SmoothWall was more than 5 mins out from the DC, breaking Kerberos. I solved that quickly by manually setting the time on our SmoothWall and then I reset the w32time service on the first DC and set it to get external time from the pool servers at ntp.org. This worked, and our clients and servers started following the domain hierarchy for time and began trusting the main DC again. Yay. However, I have done a check this morning and the DC with PDC Emulator role is no longer syncing with the external source again. I am getting event ID 47 in the event log, stating that no valid response has been received from the manually configured peer and that it will be discarded as a time source. I have followed various articles online covering unregistering and re-registering the service, and setting the service type to own. I've tried lots of different time services including time.windows.com, ntp.org and most recently ntp0.ja.net (and ntp1, ntp2 etc) and none of them work. Our firewall is allowing port 123 as I can access port 123 on portquiz.net from the DC, and if I use NtpQuery from the same machine I also get a valid response. I'm at a loss! I thought about moving the PDC Emulator role to another DC, but before doing this I attempted to set the second DC up so that it gets time externally first. It fails also! So not a problem limited to our first DC... The commands I have been running to configure the w32tm service are net stop w32time w32tm /config /syncfromflags:manual /manualpeerlist:"ntp0.ja.net ntp1.ja.net ntp2.ja.net ntp3.ja.net ntp4.ja.net" /reliable:yes net start w32time Here is a screenshot showing the event viewer error, the result from w32tm /query /peers and the success result for NtpQuery for the same peer... The server is running Server 2008R2 and fully up to date with windows updates, up to and including the April 2018 CU. Any help appreciated!
MrEprise Posted May 3, 2018 Posted May 3, 2018 (edited) Just bear in mind that if you get your internet via RM, they block all NTP servers bar their own. If not RM, check to see if your ISP has done the same thing. Edited May 3, 2018 by MrEprise
smarties11 Posted May 3, 2018 Author Posted May 3, 2018 Just bear in mind that if you get your internet via RM, they block all NTP servers bar their own. Our connection is via KCOM. I have logged a case to check that NTP is open for us on their firewalls, but as I can access port 123 on portquiz.net and also query various NTP servers successfully using NtpQuery from the same DC, that tells me it shouldn't be a firewall or blocking issue. I just don't get it?!
kevin_lane Posted May 3, 2018 Posted May 3, 2018 https://timetoolsltd.com/time-sync/how-to-synchronize-microsoft-windows-to-a-ntp-server/ see if that helps
smarties11 Posted May 3, 2018 Author Posted May 3, 2018 https://timetoolsltd.com/time-sync/how-to-synchronize-microsoft-windows-to-a-ntp-server/ see if that helps Thanks - I've checked and the registry settings are already correct as per that post.
kevin_lane Posted May 3, 2018 Posted May 3, 2018 https://servertest.online/ntp - NTP Server query i know you have had it working before but have you experienced any DNS issues ? in accessing any websites
smarties11 Posted May 3, 2018 Author Posted May 3, 2018 https://servertest.online/ntp - NTP Server query i know you have had it working before but have you experienced any DNS issues ? in accessing any websites Nope, DNS is working fine and the DC can resolve the NTP servers I am using
kevin_lane Posted May 3, 2018 Posted May 3, 2018 http://www.sysadminlab.net/windows/configuring-ntp-on-windows-server-2012 have you read this site also has some commands on enabling debug mode w32tm /debug /enable /file:C:\Temp\w32tmdebug.log /size:10485760 /entries:0-300 Turn it off again with: w32tm /debug /disable
smarties11 Posted May 3, 2018 Author Posted May 3, 2018 (edited) THINK I've sorted it. Noticed in the MS article it says there should be ,0x1 after each DNS peer address. So I started again - unregistered w32tm, re-registered - rebooted the DC and then ran net stop w32time w32tm /config /syncfromflags:manual /manualpeerlist:"0.uk.pool.ntp.org,0x1 1.uk.pool.ntp.org,0x1 2.uk.pool.ntp.org,0x1 3.uk.pool.ntp.org,0x1" w32tm /config /reliable:yes net start w32time w32tm /query /peers And I have time sync back. Will monitor and see if it keeps it this time, as this is the same position I got to yesterday..... Edited May 3, 2018 by smarties11
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now