NTP and Hyper-V

[EJWill]

Hi Folks,

 

Spent far too long getting no where, tralling through sites to find an answer, but I think i've come to my wits end.

 

We're trying to get our PDC to sync time with an external NTP server. The PDC is a VM hosted on a server running Hyper-V. By default Hyper-V will try to sync all guests with the hosts time. This has been disabled to allow us to setup the external NTP connection. This is what I used to configure our PDC:

 

net stop w32time

 

w32tm /config /update /manualpeerlist:"pool.ntp.org time.windows.com",0x1 /syncfromflags:manual /reliable:yes

 

net start w32time

 

This was deemed to be the correct way in configuring Windows Time Sync to use an external NTP server.

 

However, when querying the peers used using w32tm /query /peers it appears to have ignored my configuration entirely and stuck with the old time.windows.com and worse still if I then try w32tm /query /status it says it's still trying to sync with the LOCAL CMOS!

 

In the registry all entires are correct, it's taken my changes from earlier, but the Windows Time Service is running some kind of stubborn default that I can't work out why.

 

Any help on the matter would be greatly appreciated.

[SYNACK]

Did you restart the VMs after removing the auto time sync setting from the Hyper-V manager properties page for each. I don't think it takes effect untill after a restart.

[sjl]

I did the same 2 weeks ago only we use VMWARE. I followed the guide on Configuring the Windows Time Service and it worked fine first time.

[EJWill]

Good morrow to you two fine gentlemen,

 

Unfortunatly yes, I had already restarted the VM's. I also tried permenantly disabling the Hyper-V Time Sync Service on the server to no avail.

 

Also came across the guide you mentioned in my travels, and followed it closely, among many others that were all very similar. Still no go.

 

Edit:

 

It does appear that I have managed to at least get the peers to properly show up with w32tm /query /peers now, but the status still shows the time source and Local CMOS. At least one of the hurdles is out of the way. It ended up being group policy overiding the peers list.

 

Just got to find out how to modify the source to NTP (or why it is ignoring the w32tm config).

Edited September 29, 2010 by EJWill

[EJWill]

Just a quick update.

 

It would appear that the settings were being modified correctly, and was attempting to sync with the chosen peer. We noticed this when going through our ISA logs.

 

However, even though a connection is made and data is sent too the NTP (probably a request), we get no response back. We have tried Windows, BBC and Pool NTP's with the same results each time. We're not blocking any responses from these servers. They all just seem reluctant to service our request.

[Arthur]

I'm not sure if the following will help, but I thought it might be worth posting?

 

http://blogs.dirteam.com/blogs/sanderberkouwer/archive/2010/09/10/active-directory-time-sync-broken-by-default.aspx

 

The resolution to this problem is to make sure:

 

• Disable Time Synchronization between the virtualization platform and any virtual Domain Controller in the Integration Components/VMware tools
  
• Enable Domain Controllers in your Forest Root Domain to communicate with NTP servers on the Internet through your corporate firewall. (UDP 123)
  
• Manually configure the Domain Controller holding the Domain Controller, holding the Primary Domain Controller emulator (PDCe) Flexible Single Master Operations (FSMO) role in the Forest Root Domain with a reliable external time source,
  
• defining at least two different NTP servers by their Fully Qualified Domain Names (FQDNs)
  • defining at least two different NTP servers by their IP addresses (to make sure Time Synchronization continues to work when DNS fails)
    
  • A viable command line to configure the Domain Controller would be:
     
    w32tm /config /manualpeerlist:"europe.pool.ntp.org time.nist.gov 192.43.244.18 193.67.79.202" /syncfromflags:manual /reliable:yes /update
    

Edited September 30, 2010 by Arthur

[EJWill]

Just tried giving 2 FQDN's and 2 direct IP's.

 

Our ISA logs tell us that a connection is being initiated, but no response from any of the servers. Doesn't look like a DNS problem.

 

We go through the E2BN filters if that makes a difference, does anyone else use E2BN and able to connect to an external NTP?

[Soulfish]

Your RBC may prevent you from accessing external NTP servers. I know SEGfL does. They provide a NTP server that can be used instead.