How do you have your time set on your network?

[Sonic007]

Just doing a bit of tidying up in Group Policy and noticed I don't have the Windows Time Service configured or configured an NTP server.

 

Do you have one setup or do you just let your mahcines do their own thing?

 

Whats the best way to control time to all machines on domain?

 

 

Thanks.

[DrCheese]

You only need to worry about your domain controller (specifically the one with PDC Emulator FSMO role) having an NTP server set as all your other clients will automatically pull their time from the DC

 

(eg https://learn.microsoft.com/en-us/services-hub/health/remediation-steps-ad/configure-the-root-pdc-with-an-authoritative-time-source-and-avoid-widespread-time-skew)

[3s-gtech]

Best practice IIRC is a DC set as the single time sync source on your network/LAN, that all servers and clients sync to. That then syncs to the time server of your choice (which is rather limited on our network).

 

This method means that you shouldn't get Kerberos problems as time creeps away from the 5 minute variance allowed.

[Koldov]

As @DrCheese rightly says, on a Domain the PDC should be set as an authoritative time server, all clients get their time from this DC.

 

The PDC gets it's time from an external source such as the popular uk.pool.ntp.org

 

It's not overly complicated but can seem a bit daunting, there are plenty of threads on here about it:

 

http://www.edugeek.net/forums/windows-server-2019/229356-ntp-server-issues.html

 

http://www.edugeek.net/forums/windows-server-2019/228381-ntp-gpo-workstations-not-listening.html

 

If you have VMs

 

http://www.edugeek.net/forums/windows-server-2012/223638-time-out-dc.html

[jthompson]

If your PDC Emulator DC is a Hyper-V VM and it has the "Time synchronisation" integration service enabled in its Hyper-V settings, then the host's clock will be determining the DC's time, even if the DC is configured to use an Internet time source. If the host drifts out by a few minutes, so will the whole network.

 

AIUI, the advantage of using the integration service is that if the VM is stopped for a period of time, it'll immediatley jump to roughtly the correct time when it starts again, rather than being however long behind and causing Kerberos probs until things are brought back into tolerance.

Edited November 9, 2022 by jthompson

[Sonic007]

Thankyou everyone. Good info.