We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now


Domain Time Synch Problem

eggster34 asked
Medium Priority
Last Modified: 2009-12-16
I have a domain with 10 windows 2003 servers and 20 XP Pro clients.
I have created a GPO that would time sync the servers and the clients to an external time source (north-america.pool.ntp.org) with server type as NTP. It's been 2 days since I created and applied this policy and my domain computers and servers are still 2.5 minuyes too fast.

please help.
Watch Question

I would configure only you DC to pull the time, active directory will sync up the other servers and clients.  Then if the computers aren't synced create a group policy that points to the DC...though you shouldn't have to.....
Hi Eggster, One thing i would check (I know that this is causing us problems) is that the servers are allowed to out onto the internet on the NTP port (123 by default). If you have a firewall in place, it may be blocking requests to the time source. A lot of places will only allow access out from specific devices (Such as proxy Servers) and usuallu only on specific ports.

One way to test this could be to try and telnet to north-america.pool.ntp.org on port 123 and see if it establishes a connection. To do this, Open up a command prompt and type :

C:\>telnet 123
When you do this on our network you get :

C:\>telnet 123
Connecting To not open connection to the host, on port 123: Connect failed

Because port 123 is not allowed out of our firewall.

Give this a try and see what happens....

P.S I think that IP address is right, I just resolved the domain name you provided in your question.
Well, there's a few things that spring to mind....

Have you got port 123 (UDP) open on your firewall?  See http://support.microsoft.com/?kbid=832017 for ports that are used for services etc.  (really useful document in any case)

Are there any errors in your event logs?  

What happens when you run the command "net time /set"?

If you run "gpresult /v", does it show the GPO being applied?


I think it's a server problem.
I cannot telnet to port 123 on these servers from anywhere.. even from machines that don't have any firewalls..
would you suggest another ntp server that I can use in this casE?

when I do gpresult /v , I see that the gpo is applied to my machine.
when I do net time /set it asks me if I want to set my time to that of my domain controller and when I say it does.. but I shouldn't have to do this manually on every computer..


For your machines you can add a second route easily enough by adding a batch file in to the start up scripts in your default domain policy that just runs:

Net time /set /y

This will force all the machines to set the network time to that of the domain (the /y just adds the yes to confirm you want to set them to domain time), this way you've got some fall back if for some reason the time won't be set by AD.

For the rest of the solution, you may want to read here:


This will explain the steps in greater detail on how to set up a time source

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts


when I type net time /set

it says could not find a time server.

net time \\yourDCservername /set


Mazaraat, even that didn't work.. there was another policy that was preventing me from updating from my DC. which was the primary reason everything was failing. thanks a lot.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.