Windows Time Synchronisation

[chez]

Does anyone on here know much about Windows Server 2003 Time Synchronisation?

I'm trying to get my PDC emulator to sync with an external time source and, despite having configured it to do so, am still getting errors telling me that it is trying to sync with the domain hierarchy!

If anyone thinks they can help, feel free to post advice here, or even better shout me on MSN Messenger richard.chesterton_dsl.pipex.com (replace the _ with @)

Thanks
Chez

[Paul Adams]

Have you looked at this KB:
Your domain controller does not locate a new time source server in Windows Server 2003 (836424)

Do you have SP1 installed?
(There are a few fixes for the time service from 2003 RTM which should be rolled up in this.)

PDC emulator of the root domain should be configured to use an external time source, and if it's not directly connected to the server then you may need to apply that tweak from the KB so it uses basic NTP.

[chez]

Hi Paul

Thanks for your reply.

I haven't installed SP1 yet.

I have already set the 'Type' to 'NTP' and configured my preferred NTP servers.

I will try installing SP1.

[wasabi]

Its best to configure it in group policy in the domain controller OU.

[Paul Adams]

Its best to configure it in group policy in the domain controller OU.

Actually it's not.
You should have exactly one time source which is the master for the entire domain, and that should get its time from an external source such as an atomic clock or an Internet source.

By default, this master source is the PDC Emulator of the root domain, and every other machine in the domain uses "NT5DS" rather than NTP to maintain time in a manner that is more secure than (S)NTP as it's signed.

The design of the Windows Time service is that a machine should try to sync time with its authenticating DC, and the DCs sync with the PDC Emulator for the domain - if it is a child domain then the PDC Emulator syncs with a DC in the root domain to which it has a secure channel.

So in a standard environment you should only alter the settings on the PDC Emulator DC in the root domain, so setting a policy on the Domain Controllers OU is not the best solution.

[chez]

Thanks Paul - that is exactly the scenario I am trying to set up...

Unfortunately, my PDCE still won't play ball.....

[DJWillis]

Chez,

What other FISMO roles are on that box, is it a GC or anything else.

Been having time-sync funnies with our AD and if you give me some more info I may have some pointers.

Also, be a little bit carefull about putting SP1 on your root DC/PDCE if it's a live AD, there are a few minor urggs that may bite.

[chez]

The PDCE also holds all other FSMO roles. It is not a GC though.

Already put SP1 on - doesn't seem to have made much difference

[Paul Adams]

Basic Operation of the Windows Time Service

HOW TO: Turn On Debug Logging in the Windows Time Service

The Windows Time service may generate event ID 7023 after you upgrade to Windows Server 2003 Service Pack 1

Where are the messages appearing saying that the DC is trying to sync with domain hierarchy?
Event log? Do you have event IDs?
Any events to do with time indicate which server(s) the machine was trying to contact.

If you enable the full debugging you should be able to see if it's failing or succeeding time syncs with the external source - I have seen messages on DCs which say that a client failed to get time due to a failed security signature, but not that the master time server is trying to use the domain as a time source...