Offsite Time Sync

[smarties11]

Hi All,

 

Our clients all update their time from our on-site DCs. We have a few people working from home at the moment, and as we don't use a VPN the DCs are not available for them to time sync. Consequently their time is now an hour behind, which obviously causes major issues with SSL. We've corrected manually for now, but I wondered if there is a way to specify (by group policy for example) a secondary time server when DCs are not available? I can't find anything online about this, I can see the time sync settings at Administrative Templates | System | Windows Time Service; but we don't configure anything here, the clients start syncing with our DCs when on the domain and I don't want to override this or create any issues with this.

 

Thanks!

[Jcx500]

Im sure there is a gpo where you can configure multiple ntp servers

[Steve21]

If I remember correctly you can modify the GPO to use AllSync instead of NTP, that will auto to domain hier but then fallback to the specific NTP you set in the GPO if it fails (e.g. by default uses DC, then set an external NTP in the normal NTP setting)

 

Steve

[smarties11]

If I remember correctly you can modify the GPO to use AllSync instead of NTP, that will auto to domain hier but then fallback to the specific NTP you set in the GPO if it fails (e.g. by default uses DC, then set an external NTP in the normal NTP setting)

 

Steve

 

Yes, this is exactly what I am after. I don't want to change any settings that lose or interfere with the domhier sync as I know this could lead to massive issues. I'll look into allsync and apply only to our offiste clients. Thank you for pointing me in the right direction!

 

EDIT: Just to add that this worked perfectly. For anyone else, the GPO location is Computer Configuration > Administrative Templates > System > Windows Time Service > Time Providers and then enable the policy 'Configure Windows NTP Client'. Pop your preferred time server(s) in and change the type to 'AllSync' which still syncs via the domain hierarchy first, falling back to time server if not available.

Edited March 30, 2021 by smarties11