Time Server Question

[Ste_Harve]

Hi all,

 

Having a problem with w32tm and kerberos. Our dc's are virtual and keep loosing time, minutes over a 24 hour period, the clients don't so this causes all sorts of problems with group policy and everything.

 

I've tried to set the time server on the DC to sync to an external NTP source but it doesn't. Can someone point me in the right direction to get this to work? We're on lancsngfl and do they have a ntp server? If so i'd like to sync with them.

 

And has anyone had experiences of clocks running slower in VM esxi and if so any solutions to fix it?

 

Cheers,

[3s-gtech]

I run timesync on every server for this, used to find we'd get a time skew between domains in the forest and susequent logon problems. We then use our local authority time server for each instance, plus our CCTV, VPN etc. Clients sync from the DC.

[pcstru]

Hi all,

And has anyone had experiences of clocks running slower in VM esxi and if so any solutions to fix it?

 

Yes. Make sure the ESXi host is set to sync up from a timeserver. BUT bear in mind that ESX will not regard windows time services as being accurate enough so if you have them set to take time from a windows machine, they will likely just ignore it. Point them at a more authoritative source, say from your provider (if they run ntp services) or the uk.pool.ntp.org.

[timzim]

Why doesn't your DC sync to an external time server? Have you got a firewall in the way and if so, which one? Can any machine sync to an external source? You need to investigate this first.

[glennda]

If you are part of an LEA WAN you may find they have there own time server - I know mine does and you can't contact any other time servers you need to use theres.

[timzim]

If you are part of an LEA WAN you may find they have there own time server - I know mine does and you can't contact any other time servers you need to use theres.

 

Only if you get all your content through their proxies and they're blocking ntp from anywhere else.

[glennda]

Only if you get all your content through their proxies and they're blocking ntp from anywhere else.

 

thats what i meant

[timzim]

thats what i meant

 

Sorry. Sounds typical of an LEA! If you've got your own proxy server chaining up to theirs you could create a bypass list & rule for certain sites (e.g. a list of NTP server sites) so you can get around their stupidity...er, I mean...security. We've done the very same.

[glennda]

Sorry. Sounds typical of an LEA! If you've got your own proxy server chaining up to theirs you could create a bypass list & rule for certain sites (e.g. a list of NTP server sites) so you can get around their stupidity...er, I mean...security. We've done the very same.

 

We do forward all our proxy onto them - but there is no way of getting out to the sites as they are all blocked! but their time server is pretty reliable - its normally bang on as it just gets the time from the internet and then we get it from them!

[chazzy2501]

SWGFL or my LEA (I forget) have a time server,(so proxy is no issue) I use it with my virtual DC and it works great. I just phoned them up and asked if they had one.

 

EDIT... Ok I reread the posts so maybe one of these? GPS TIME SERVER

Edited March 14, 2011 by chazzy2501

[localzuk]

Sorry. Sounds typical of an LEA! If you've got your own proxy server chaining up to theirs you could create a bypass list & rule for certain sites (e.g. a list of NTP server sites) so you can get around their stupidity...er, I mean...security. We've done the very same.

 

Time servers don't run on port 80, so in my experience, unfiltering them won't make any difference. NTP ports would come under their general firewall rules, rather than web filtering.

[Ric_]

LancsNGfL do block NTP but I'm pretty sure that they provide an NTP server... I just cannot remember what it is. Best bet is to ring Westfield and ask them for the details.