smarties11 Posted March 30, 2021 Posted March 30, 2021 Hi All, Our clients all update their time from our on-site DCs. We have a few people working from home at the moment, and as we don't use a VPN the DCs are not available for them to time sync. Consequently their time is now an hour behind, which obviously causes major issues with SSL. We've corrected manually for now, but I wondered if there is a way to specify (by group policy for example) a secondary time server when DCs are not available? I can't find anything online about this, I can see the time sync settings at Administrative Templates | System | Windows Time Service; but we don't configure anything here, the clients start syncing with our DCs when on the domain and I don't want to override this or create any issues with this. Thanks!
Jcx500 Posted March 30, 2021 Posted March 30, 2021 Im sure there is a gpo where you can configure multiple ntp servers
Steve21 Posted March 30, 2021 Posted March 30, 2021 If I remember correctly you can modify the GPO to use AllSync instead of NTP, that will auto to domain hier but then fallback to the specific NTP you set in the GPO if it fails (e.g. by default uses DC, then set an external NTP in the normal NTP setting) Steve 2
smarties11 Posted March 30, 2021 Author Posted March 30, 2021 (edited) If I remember correctly you can modify the GPO to use AllSync instead of NTP, that will auto to domain hier but then fallback to the specific NTP you set in the GPO if it fails (e.g. by default uses DC, then set an external NTP in the normal NTP setting) Steve Yes, this is exactly what I am after. I don't want to change any settings that lose or interfere with the domhier sync as I know this could lead to massive issues. I'll look into allsync and apply only to our offiste clients. Thank you for pointing me in the right direction! EDIT: Just to add that this worked perfectly. For anyone else, the GPO location is Computer Configuration > Administrative Templates > System > Windows Time Service > Time Providers and then enable the policy 'Configure Windows NTP Client'. Pop your preferred time server(s) in and change the type to 'AllSync' which still syncs via the domain hierarchy first, falling back to time server if not available. Edited March 30, 2021 by smarties11 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now