Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 275
  • Last Modified:

net time returns a DC in an alternate site that's not the PDC Emulator

Why does the "net time" command run on an XP or W2K workstation (that are joined to a W2K native mode AD) return a domain controller in another site that does not hold the PDC Emulator role ?

The XP workstation, W2K workstation and the PDC Emulator are in different subnets bound to the same site.

Also, W2K domain controllers in a third site also return the same value.

It seems to me, these machines should be returning the value of the PDC Emulator for the domain.

0
kevinbeamer
Asked:
kevinbeamer
2 Solutions
 
mikeleebrlaCommented:
if your workstation in question is XP and your domain is 2000 native  then the PDC emulator role is irrelivant.... as the PDC Emulator role is for backward compatibility with NT 4.0 DCs ...  the net time command will return the value of the autoritative time server for your domain, NOT the PDC emulator.  below is a link that explains how to set up the authoritative time server for your domain.  which site they are in is 100% irrelivant,,, as the time is set for the domain,,, not the site


http://support.microsoft.com/default.aspx?scid=216734
0
 
kevinbeamerAuthor Commented:
i think i've stumbled onto a microsoft undocumented feature :)

workstations, member servers and dc's in the same domain use the domain controller that comes first in the alphabet

even the pdc emulators themselves...

i know this sounds silly, but try it for yourself...

add a dc with an alphabetical name thats "higher" on the list and watch the output of "net time" shift to the new server.

i've tested this in all 5 domains in our forest and each time the result was predictable
0
 
JamesDSCommented:
A few problems here !

The windows time service will sync workstations with the local DC and DCs will sync with the PDC emulator for the domain and then up through the forest to the root PDCE.

The PDCEmulator IS NOT IRRELEVANT ON AN AD DOMAIN. It is used (among many other things) for the timesynch and for "urgent" replication and password checking on recent change.

The NET TIME command WILL NOT NECESSARILY RETURN THE VALUE OF THE AUTHORITATIVE TIME SERVER FOR YOUR DOMAIN, it will return the time at the DC you authenticated against when you last booted up and logged on. If you run it at a DC it will return the time from the PDCEmulator for your domain.

The reason you seem to be getting the "highest" DC returning time is that all your DCs being tested are probably in the same site as you are and when DNS is queried for a local DC, it will return the IP of the DC first in the list - very possibly alphabetically.

If you had multiple sites and subnets and these were setup correctly then the DC returned would be the local one for your site.


Cheers

JamesDS
0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now