Domain Controller NTP Time Synchronisation

If you work with Windows Domains and Active Directory and Kerberos you will know there will be issues if your clients clock are not within 5 minutes of your servers. As standard your domain joined clients should synchronise their time with the PDC emulator on the domain. This is not usually an issue and works well by default (usually!).
When you do start to get issues is when the clock on your PDC emulator starts to skew and all the clients skew to match it. This does not cause issues for your network but the time on all the computers is wrong an inevitably people will start complaining.

So lets just synchronise with one of those nice NTP clocks on the internet, that's easy right you just look at the clock options and set it there like on standard Windows 7 etc. Well unfortunately it's not that easy as you do not get the option to do that instead you need to go through a fairly complicated set up and take a few things into consideration.

Lets start with the service that controls the time

 w32time 

and the command you use to configure various options:

 w32tm 


You can use the following command to check a couple of things:

1. You can see if you can access the NTP server.
2. You can see how far your clock is out according to the NTP.


 w32tm /stripchart /computer:time.server.com /samples:3


If you can't contact the NTP server then try another server or check your firewall isn't blocking it.
The port for NTP is port 123 UDP


If all is well you can check the current config by diving into the registry under:


HKLM\SOFTWARE\Policies\Microsoft\W32time\Parameters


or you can use the command:

 w32tm /dumpreg /subkey:Parameters 

The screenshot above is from my home PC but the settings will be the same on domain joined PCs except the NTP client mode which is the 0x9 next to time.windows.com. On your domain the settings for the time source will use the 0x8 client mode which sets the local computer to operate in client mode in association with the preceding time server.

To set the time server you can use the following command:

 w32tm /config /manualpeerlist:time.server.com,0x8 /syncfromflags:MANUAL /reliable:yes 

Make sure you substitute the time server address you want to use in that command. pool.ntp.org comes highly recommended for a reliable time source.

All you need to do then is stop and restart the service: and give it a chance to refresh it

 net stop w32time && net start w32time 

If you want to force a refresh you can use the command:

 w32tm /resync /nowait 


The last step in troubleshooting is to check the settings for type under the subkey parameters.
In the screenshot above the type is NTP which is right for the server (PDC Emulator) that you want to be contacting the external time source. The setting on your clients must be NT5DC though as this means they seek the time from the domain hierarchy ie the PDC emulator (I may have mentioned that before ;-) )

To fix your client settings from the command line you can execute the command:

 w32tm /config /syncfromflags:domhier /update 

This should not need doing as by default this should be the normal setting.


Now working in a domain environment you can also use Group Policy to control these settings:

These are located in the following location:

Computer Configuration > Administrative Templates > System > Windows Time Service

I have used a GPO to target all the domain controllers with the NTP settings. You may want to filter that more in your environment.

So there you have it, the idea sounds simple but once you start looking into it, it's a lot more complicated!