Network Time Servers

[GrumbleDook]

As part of some questions I have had recently I am investigating the use of Network Time Servers within schools.

 

Can people let me know if they use an external one to synchronise to, and what the details of it are, including whether you have to be authorised to use it?

 

I have been made aware of some so far, but just wanted to get details from others first.

[cromertech]

My main server syncs to microsoft. This is default time server. All other computer are set to sync of server through group policy

[teejay]

I sync our primary dc to a time server at the LEA and then the network syncs it's time to that. All othe time servers are blocked by the LEA.

[sparkeh]

With regards to time servers and networks, this is an interesting read from MS: How to configure an authoritative time server in Windows Server

Most salient point:

the PDC operations master at the root of the forest becomes authoritative for the organization. We highly recommend that you configure the authoritative time server to gather the time from a hardware source. When you configure the authoritative time server to sync with an Internet time source, there is no authentication.

[RobFuller]

I sync my DC's to uk.pool.ntp.org

[Mako]

We have our own time server, and all our servers sync to that. It connects to an antenna on the roof, which obtains its time information from satellites and whatnot. The rack mounted box connects to the network via ethernet, has an assigned IP address, and the servers just look to that address for their time sync.

 

We've had issues with the antenna, such as weather damage and generic faults, which had caused us to send for replacements and fit them ourselves.

 

Other than that, no problems. Works as it should.

 

For reference, our NTP Time Server is supplied by Galleon - Atomic clock for correct time using Anthorn MSF, DCF and WWVB

[achedgy]

I sync all my schools to swgfl time server ntp.swgfl.org.uk

[glennda]

Internet - LA Time Server - DC - Clients

 

All other time servers are blocked.

[steve]

I sync our core switch to the regional broadband time server.

 

Servers are sync'd from the core switch, PCs for the servers.

 

Everything else - switches, APs, CCTV cameras, telephone system etc., are all sync'd from the core switch.

[Michael]

I believe BGFL in Birmingham block all time servers apart from their own NTP.BGFL.ORG. It's reliable in my experience.

 

It's generally recommended that the primary server at each site uses NTP.BGFL.ORG and all workstations within a school should synchronise with that server. It makes sense, as typically the same server would be used for other purposes like authenticating logons, roaming profiles and documents for example.

[Geoff]

Yes that's best practice. More info here.

 

RulesOfEngagement < Servers < NTP

[webman]

Smoothwall syncs with uk.pool.ntp.org.

Servers sync with Smoothwall.

Workstations sync with servers.

 

School bell system is too old to support NTP, so it's adjusted by hand

[Roberto]

As part of some questions I have had recently I am investigating the use of Network Time Servers within schools.

 

Can people let me know if they use an external one to synchronise to, and what the details of it are, including whether you have to be authorised to use it?

 

I have been made aware of some so far, but just wanted to get details from others first.

 

We used to sync to one - you didn't need to ask for the major public time servers (from a technical point of view, you don't usually *need* to ask at all, if you see what I mean).

 

We have since purchased our own time server and run that on-site for our needs. We actually offered access to this as a service to other members of the educational community for a while.

 

When people have asked me about using a time server on site (whether their own or connecting to someone else's) I reccomend that one or maybe two servers sync time with the upstream time service and then workstations / other servers take time from those servers. For things like Kerberos in Active Directory or similar (or more 'mundane' stuff like time for door control, CCTV, etc) its probably more important that all the clocks on site reliably agree with each other than it is that they all get the "correct" time from somewhere else.

Edited September 29, 2011 by Roberto

[DAZZD88]

I sync our primary dc to a time server at the LEA and then the network syncs it's time to that. All othe time servers are blocked by the LEA.

 

Same for us. This probably the best way as I have read that there can be security issues with time servers (probably only unknown time servers).

[pete]

uk.pool.ntp.org no auth needed.

[GrumbleDook]

Many thanks for all the responses so far (including the emails).

 

In general we have 3 options.

1 - use an LA provided service

2 - purchase a radio-enabled device which synchronises to an external time server

3 - use a public service and uk.pool.ntp.org seems to be the most popular.

 

Now I have another question, based on some of the responses above.

What device do you set inside your school as your NTP server? We have examples of your DCs, a core switch and a dedicated machine / device? I am tempted to say the DCs (or a single DC anyway) ...

 

Opinions?

 

I will shortly be writing this up to include in our RBC documentation so examples of practice is appreciated.

[pete]

What device do you set inside your school as your NTP server?

 

uk.pool.ntp.org < internal ntp box < DC < clients
                           ^
                       Network & Storage hardware that need a time source before the DCs come up

If I put a hostname or fqdn into a switch config, it'll do a DNS lookup, convert it into an IP address and save that in the config.

 

With a dedicated NTP box, I can swap hardware and give it the same name / IP without breaking anything else. I don't want ReplacementDC on the same IP as OldDC because I'll phase one in and let it percolate before I phase the other out.

[TheCrust]

What device do you set inside your school as your NTP server?

 

We have a dedicated NTP server - it cost us £350 IIRC from Red Herring (http://www.ntptimeserver.co.uk). It's a simple little thing - cisco hardware with their own software on it and a USB GPS receiver plugged in the back. One of our DCs is set to use it as an authoritive time source, and it just works for us.

[Geoff]

Best practice for a Windows Domain is to Sync to your DCs (as you need kerberos to work!).

 

Windows Time Service Best practices: Security Services; Core Services