Time keeps going out of sync on domain controller.

[Davit2005]

Had another look at this as it went 12mins out of sync again today.

 

We have 2 domain controllers, and have had issue with time sync occasionally since before I started here.

 

The DC that holds the FSMO roles including the PDC emulator (still Server2003) is set up for type NT5DS (look at the domain for it's time). It has no NtpServer key.

 

Since being here I have brought in a 2008 R2 after doing all the DCPROMO on the schema as per MS docs.

 

The 2008 R2 as well as having the type set to NT5DS (look at the domain for it's time), has also got the NtpServer key set to time.windows.com,0x9.

 

What does the 0x9 mean? and Shouldn't the DC with the PDC Emulator role have a NtpServer key set?

[glennda]

You will need to setup the PDC to get its time from an external time source - normally RBC's provide time servers and things like time.windows.com are blocked.

 

You will need to run something like "w32tm /config /manualpeerlist:”time.windows.com” /syncfromflags:manual /reliable:yes /update"

 

replacing time.windows.com with your time server whether it be the RBC's or use ntp.org's (as i do on all my clients). 0.pool.ntp.org

 

you will then need to run "net stop w32tm" and net start "W32tm"

 

 

EDIT: if your servers are virtual make sure your host gets its time from the external source as well otherwise the host and DC get the time from each other causing issues

Edited September 20, 2012 by glennda

[Davit2005]

You will need to setup the PDC to get its time from an external time source - normally RBC's provide time servers and things like time.windows.com are blocked.

 

You will need to run something like "w32tm /config /manualpeerlist:”time.windows.com” /syncfromflags:manual /reliable:yes /update"

 

replacing time.windows.com with your time server whether it be the RBC's or use ntp.org's (as i do on all my clients). 0.pool.ntp.org

 

you will then need to run "net stop w32tm" and net start "W32tm"

 

 

EDIT: if your servers are virtual make sure your host gets its time from the external source as well otherwise the host and DC get the time from each other causing issues

 

Yep the DC's are all virtual so have setup 4 NTP Servers on each host 0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org

 

Looking at doing the PDC Emulator next but not sure what to do about the other DC, is it possible to have a backup ntp setup or is it not really needed?

[sonofsanta]

Don't use 0.pool.ntp.org etc. - use 0.uk.pool.ntp.org etc.

 

pool.ntp.org: NTP Servers in United Kingdom, uk.pool.ntp.org

[adhutton]

We use this NetTime - Network Time Synchronization Tool

 

Andrew

[Davit2005]

Don't use 0.pool.ntp.org etc. - use 0.uk.pool.ntp.org etc.

 

pool.ntp.org: NTP Servers in United Kingdom, uk.pool.ntp.org

 

Yep have used uk.pool.ntp.org, you spotted my typo, it's being a lonk week

[sonofsanta]

Yep have used uk.pool.ntp.org, you spotted my typo, it's being a lonk week

 

A lonk week, huh?

 

uk.pool.ntp.org seems to be 2 minutes ahead of what Google tells me GMT is, though, which is making all the computers out of line with bells etc. Anyone else getting this?

[glennda]

Yep the DC's are all virtual so have setup 4 NTP Servers on each host 0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org

 

Looking at doing the PDC Emulator next but not sure what to do about the other DC, is it possible to have a backup ntp setup or is it not really needed?

 

As long as the PDC has the correct time it should be authoritve over the secondary DC - which means the second DC should sync from the PDC.

 

Just make sure when using the Pools that you can actually get out on the correct ports as all well and good pointing servers to the pools but if they cannot contact they will just fail but not tell you

[sonofsanta]

uk.pool.ntp.org seems to be 2 minutes ahead of what Google tells me GMT is, though, which is making all the computers out of line with bells etc. Anyone else getting this?

 

Yeah, turns out I'm an idiot and forgot that the DC doing the time thing is, of course, virtual. Setting the virtual hosts to sync from ntp as well means everything is now nicely on time.