Domain Time Synch Problem

Hello
I have a domain with 10 windows 2003 servers and 20 XP Pro clients.
I have created a GPO that would time sync the servers and the clients to an external time source (north-america.pool.ntp.org) with server type as NTP. It's been 2 days since I created and applied this policy and my domain computers and servers are still 2.5 minuyes too fast.

please help.
eggster34Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MazaraatCommented:
I would configure only you DC to pull the time, active directory will sync up the other servers and clients.  Then if the computers aren't synced create a group policy that points to the DC...though you shouldn't have to.....
0
ian_chardCommented:
Hi Eggster, One thing i would check (I know that this is causing us problems) is that the servers are allowed to out onto the internet on the NTP port (123 by default). If you have a firewall in place, it may be blocking requests to the time source. A lot of places will only allow access out from specific devices (Such as proxy Servers) and usuallu only on specific ports.

One way to test this could be to try and telnet to north-america.pool.ntp.org on port 123 and see if it establishes a connection. To do this, Open up a command prompt and type :

C:\>telnet 216.194.70.2 123
 
When you do this on our network you get :

C:\>telnet 216.194.70.2 123
Connecting To 216.194.70.2...Could not open connection to the host, on port 123: Connect failed

Because port 123 is not allowed out of our firewall.

Give this a try and see what happens....

P.S I think that IP address is right, I just resolved the domain name you provided in your question.
0
essaydaveCommented:
Well, there's a few things that spring to mind....

Have you got port 123 (UDP) open on your firewall?  See http://support.microsoft.com/?kbid=832017 for ports that are used for services etc.  (really useful document in any case)

Are there any errors in your event logs?  

What happens when you run the command "net time /set"?

If you run "gpresult /v", does it show the GPO being applied?



0
Cloud Class® Course: Microsoft Azure 2017

Azure has a changed a lot since it was originally introduce by adding new services and features. Do you know everything you need to about Azure? This course will teach you about the Azure App Service, monitoring and application insights, DevOps, and Team Services.

eggster34Author Commented:
I think it's a server problem.
I cannot telnet to port 123 on these servers from anywhere.. even from machines that don't have any firewalls..
would you suggest another ntp server that I can use in this casE?

when I do gpresult /v , I see that the gpo is applied to my machine.
when I do net time /set it asks me if I want to set my time to that of my domain controller and when I say it does.. but I shouldn't have to do this manually on every computer..
0
eggster34Author Commented:
hello?!?
0
ian_chardCommented:
For your machines you can add a second route easily enough by adding a batch file in to the start up scripts in your default domain policy that just runs:

Net time /set /y

This will force all the machines to set the network time to that of the domain (the /y just adds the yes to confirm you want to set them to domain time), this way you've got some fall back if for some reason the time won't be set by AD.

For the rest of the solution, you may want to read here:

http://www.windowsnetworking.com/articles_tutorials/Configuring-Windows-Time-Service.html

This will explain the steps in greater detail on how to set up a time source

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
eggster34Author Commented:
when I type net time /set

it says could not find a time server.
0
MazaraatCommented:
net time \\yourDCservername /set
0
eggster34Author Commented:
Mazaraat, even that didn't work.. there was another policy that was preventing me from updating from my DC. which was the primary reason everything was failing. thanks a lot.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.