dcdiag error 'time privider error'

[edutech4schools]

just moved all roles to a new server and ran dcdiag on new server, which gives this error:

 

Time Provider NtpClient: This machine is configured to use the domai

n hierarchy to determine its time source, but it is the AD PDC emulator for the

domain at the root of the forest, so there is no machine above it in the domain

hierarchy to use as a time source. It is recommended that you either configure a

reliable time service in the root domain, or manually configure the AD PDC to s

ynchronize with an external time source. Otherwise, this machine will function a

s the authoritative time source in the domain hierarchy. If an external time sou

rce is not configured or used for this computer, you may choose to disable the N

tpClient.

 

Odd that I have installed many 2008r2 servers and none gave this error.

 

Any help with a fix.

Cheers

[edutech4schools]

just ran dcdiag again and all passed. not sure why that was but time healed it on this occasion.

[Blue_Cookeh]

I know it passed the chec, but just thought I'd say... the PDC emulator in your domain has to be the network time server, if you move the FSMO role to a new server, you should run something like below to sync the time up.

 

w32tm /config /manualpeerlist:"" /reliable:yes /update

[edutech4schools]

ok I will give that a go in the morning.

[edutech4schools]

w32tm /config /manualpeerlist:"

" /reliable:yes /update

 

Just before I run your command why when I do a search for time sync do most forums come back with something similar to the following?

 

1. First, locate your PDC Server. Open the command prompt and type: C:\>netdom /query fsmo
   
2. Log in to your PDC Server and open the command prompt.
   
3. Stop the W32Time service: C:\>net stop w32time
   
4. Configure the external time sources, type: C:\> w32tm /config /syncfromflags:manual /manualpeerlist:”0.pool.ntp.org, 1.pool.ntp.org, 2.pool.ntp.org”
   
5. Make your PDC a reliable time source for the clients. Type: C:\>w32tm /config /reliable:yes
   
6. Start the w32time service: C:\>net start w32time
   
7. The windows time service should begin synchronizing the time. You can check the external NTP servers in the time configuration by typing:C:\>w32tm /query /configuration
   
8. Check the Event Viewer for any errors.
   

 

Do they both do the same thing?

[Blue_Cookeh]

They're the same thing, but those steps walk you through it in it's entirety. So long as you know what server is holding the PDC role you can just do steps 3 -> 6.

 

Most LEAs block outbound NTP (I don't understand why, but there we go) so you might need to substitute x.pool.ntp.org for your LEA's time server.

[edutech4schools]

I have changed the time to sync with our LEA but the server is 2 minutes fast against a GMT website. I have waited over an hour and running w32tm /query /configuration

looks ok. I have also checked the firewall.

Any idea why it might not be working.

[edutech4schools]

This is the result of w32tm /query /configuration

[Configuration]EventLogFlags: 2 (Local)

AnnounceFlags: 5 (Local)

TimeJumpAuditOffset: 28800 (Local)

MinPollInterval: 6 (Local)

MaxPollInterval: 10 (Local)

MaxNegPhaseCorrection: 172800 (Local)

MaxPosPhaseCorrection: 172800 (Local)

MaxAllowedPhaseOffset: 300 (Local)

 

 

FrequencyCorrectRate: 4 (Local)

PollAdjustFactor: 5 (Local)

LargePhaseOffset: 50000000 (Local)

SpikeWatchPeriod: 900 (Local)

LocalClockDispersion: 10 (Local)

HoldPeriod: 5 (Local)

PhaseCorrectRate: 7 (Local)

UpdateInterval: 100 (Local)

 

 

 

 

[TimeProviders]

NtpClient (Local)

DllName: C:\Windows\system32\w32time.dll (Local)

Enabled: 1 (Local)

InputProvider: 1 (Local)

AllowNonstandardModeCombinations: 1 (Local)

ResolvePeerBackoffMinutes: 15 (Local)

ResolvePeerBackoffMaxTimes: 7 (Local)

CompatibilityFlags: 2147483648 (Local)

EventLogFlags: 1 (Local)

LargeSampleSkew: 3 (Local)

SpecialPollInterval: 3600 (Local)

Type: NTP (Local)

NtpServer: "ntp.segfl.ifl.net" (Local)

 

 

NtpServer (Local)

DllName: C:\Windows\system32\w32time.dll (Local)

Enabled: 1 (Local)

InputProvider: 0 (Local)

AllowNonstandardModeCombinations: 1 (Local)

 

 

VMICTimeProvider (Local)

DllName: C:\Windows\System32\vmictimeprovider.dll (Local)

Enabled: 1 (Local)

InputProvider: 1 (Local)

 

 

[edutech4schools]

Found this in the logs

NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on '%3'. NtpClient will try again in %2 minutes and double the reattempt interval thereafter. The error was: The requested name is valid but no data of the request was found.

[Michael]

I have changed the time to sync with our LEA but the server is 2 minutes fast against a GMT website. I have waited over an hour and running w32tm /query /configuration

looks ok. I have also checked the firewall.

Any idea why it might not be working.

 

Well you'd hope your LA are using a time server themselves and not an in-house server, which will over time (no pun intended) go out of sync. I use BGFL's time server and it's spot on when I check with other time server websites. If it wasn't I wouldn't use it as it could affect logons if times are more than 5 mins apart.

[edutech4schools]

Found that it was a DNS name resolution error so entered IP rather name. Then did a w32tm /resync but got the error 'the computer did not resync because no time data was available.'

 

All school in the area are using the same time server, so should be OK time wise.

 

How do I add a forwarder to DNS?

[edutech4schools]

or do I need to add PTR record. (Not so hot with DNS)

 

Cheers

[Michael]

Open up DNS, right click the servername and select Properies > Forwarders. Enter the IPs here.

 

I also enable DHCP Server options 004 and 042. Again enter the IP.

[edutech4schools]

OK this is the error I am getting at the moment

Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the PDC emulator for the domain at the root of the forest. There is no machine above this machine in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure this PDC emulator in the root domain to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.

 

On the MS page it says this is the command that should be used

w32tm /config /manualpeerlist:server,0x8, /syncfromflags:manual /update

Note the 0x8 after server and syncfromflags that are different from the original post by blue_cookeh

 

I will not be able to test until next week but do you think the 0x8 and syncfromflags will make a difference?

[Michael]

0x8 generally means an error of some sort. As to what you should check the event logs.

[edutech4schools]

You are wrong. Just did a search and came back with lots of sites saying you should add it in the time command

 

It appears that in Windows XP, 2003, and Vista, the Windows Time Service (w32time) will by default always try to form a "symmetric active" association with configured NTP servers. This can be problematic with some time servers, violates the published RFC-1305specification, and is not necessary. I could find no explanation on Microsoft's site for this behavior; I suspect it has something to do with interoperability with older Windows 2000 domain controllers that had very broken NTP.

 

However, there is a simple workaround. You can simply add ",0x8" to the end of any configured time server, and Windows will only use a client-mode association. For example, the command:w32tm /configure /manualpeerlist:"0.pool.ntp.org,0x8 1.pool.ntp.org,0x8 2.pool.ntp.org,0x8" /syncfromflags:MANUAL /update

will configure your Windows machine to form client-mode associations with three differentNTP Pool servers.

 

 

or

Which NTP-server to use? Or several?

 

The pool.ntp.org is a round-robin of random selected NTP servers. As they say "This is usually good enough for end-users". But you might want to add several NTP-servers yourself for redundancy?

 

w32tm /config /manualpeerlist:"ntp1.sp.se ntp2.sp.se",0x8 /syncfromflags:MANUALJust keep adding them with a space in between them.