DC time sync

[itgeek]

Hi,

 

I have been experiencing an issue with time synchronization on the network. When I manually change this on one of our two domain controllers the devices sync and all is ok. However after a period of time it will loose time both on the dc and the devices. Do I need to sync both dc to a time source? If so how is this done.

 

Thanks

[willtech]

see: https://learn.microsoft.com/en-gb/archive/blogs/nepapfe/its-simple-time-configuration-in-active-directory

[MartinT]

Run this in an elevated command prompt (or put it in startup) on the DC...

 

w32tm /config /update /manualpeerlist:time.windows.com (or use the NTP of a local, e.g. UK, time server)

[Warwick_Tech]

I had a similar issue, used this code from a web forum; use at your own risk o/c

 

@ECHO OFF

CLS

ECHO.

ECHO.

ECHO NOTE: This must be run with administrative privileges!

ECHO If you did not right-click on this .bat and select

ECHO "Run as administrator" then exit now and run again

ECHO.

ECHO.

PAUSE

ECHO.

ECHO Setting SNTP server...

sc stop W32Time

TIMEOUT 3

W32tm /config /syncfromflags:manual /manualpeerlist:"time.windows.com"

W32tm /config /reliable:yes

TIMEOUT 2

sc start W32Time

TIMEOUT 3

W32tm /config /update

W32tm /resync

TIMEOUT 2

ECHO.

ECHO. Done!

ECHO.

PAUSE

EXIT

[jthompson]

If your affected DC is a VM, check also that it's not having its clock set by the hypervisor. That won't be reflected in any W32tm settings in guest (DC) OS.

[Olliedawg]

If you are using ESXi any VM with VMtools installed should get the time from the hypervisor as jthompson said.

 

step 1 = enable NTP on the hypervisor, set NTP service to autostart with hypervisor

step 2 = set the NTP server to 0.uk.pool.ntp.org, 1.uk.pool.ntp.org

step 3 = relax

 

I've had 0 time issues with this method

[MartinT]

Also check that you have the NTP port 123 open for UDP traffic in your firewall.

[psydii]

I’ve not seen it myself but this could be part of it:

 

“W32Time in Server 2016 includes the Secure Time Seeding feature. This feature determines the approximate current time from outgoing SSL connections. This time value is used to monitor the local system clock and correct any gross errors.”

 

Yup. If a random cert/server on the internet has the wrong time, it can mess up the time on your DC.

 

The view of an AD Escalation engineer at Microsoft:

 

https://x.com/josephryanries/status/1488342795874193412

 

A write up on Arstechnica a few months after that tweet:

 

https://arstechnica.com/security/2023/08/windows-feature-that-resets-system-clocks-based-on-random-data-is-wreaking-havoc/

 

Chat from last week about this very behaviour breaking a site this year!

 

 

Turn that feature off!

 

https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-server-2016-improvements#secure-time-seeding

 

Of course as the escalation engineer and other on this edugeek thread say, there are many ways time can be set automatically, so this might not be the actually cause, but it should be disabled to prevent it being the problem.

[DavonPotter]

Syncing both domain controllers to a reliable time source is usually recommended to maintain consistent time across devices. You can configure this by setting up one of your DCs to sync with an external time server and then configuring the second DC to sync with the first one. Depending on your server OS, there are plenty of guides online.

[MartinT]

I used to sync both of my DCs to the same external UK time server, which ensured they were within a few milliseconds of each other.

[psydii]

I have literally woken up in a cold sweat thinking about ways this can go wrong: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/fixing-when-your-domain-traveled-back-in-time-the-great-system/ba-p/255877

https://www.researchgate.net/publication/334244678_Impact_of_GPS_Time_Spoofing_Attacks_on_Cyber_Physical_Systems

[jthompson]

As long as the DC that holds your PDC emulator FSMO is syncing its clock with an Internet time source, other DCs will sync from that PDC emulator, with everything else in the domain syncing from any of the DCs.

 

I believe that's how time sync in Windows domains is designed to work: the PDC being the authoritative time source for the entire domain.