Time Synchronization Windows 2003, 2000, XP to Cisco 2821 Router

Yes!  It's time for yet another time sync question...

I have this working in my environment now, but have a few questions.

I modified the Domain Default Policy GPO which works great at the desktop level but seems to have no affect at the server level:

NtpServer x.x.x.x,0x1
Type NTP
CrossSiteSyncFlags 2
ResolvePeerBackoffMinutes 15
ResolvePeerBackoffMaxTimes 7
SpecialPollInterval 3600
EventLogFlags 0

One Windows 2003 servers, I modified the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters) NtpServer and Type strings.  I also typed the NTP Server IP address into the "Date and Time Properties | Internet Time | Server" field and checked "Automatically synchronize..."

On the Windows 2000 servers I used the "net time \\servername /setsntp:x.x.x.x" command and stopped and restarted the W32Time service.

The questions:

1.  What is a good stratus 1 time server IP address I can use?  I'd like to use a DNS name, but am not sure how well that will work from the router.  How can I compare the time at this server to my environment to ensure accuracy?
2.  Why won't the GPO work on the servers?  Can I modify it or create another one to work for them?  I want all devices to NTP off the router.
3.  Are the things I've done as listed above sufficient for the servers?  I still see some discrepancies.
4.  Do GPO settings override the registry settings at the desktop level?  I can still see NTP registry setting that do not match the GPO.
5.  I'd also like to setup our Avaya phone switch to sync with the router.  Anyone done this before?
6.  Can I get consistency throughout my environment using this methodology and without having to buy additional equipment?
LVL 3
isd503Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Kevin HaysIT AnalystCommented:
I'll attempt to answer a few of the questions.

1. net time /setsntp:tick.usno.navy.mil
- I currenly use this on my DC to sync the time.  I then have a startup script via GPO for all the workstations/servers to use 'net time \\servername /set /yes'
2.  Don't see why it doesn't if you do it in a fashion that i've used above.
3. I've not really done any of this, but I do keep an eye on the time for all the servers to make sure they stay in sync and they haven't gotten out of sync yet.  I may be lucky i'm not sure though, but i've not touched this part in over a year though.
4. The last GPO that will effect the computer/user will be the child GPO of an OU.  Example of order GPO's will get processed.
- Local Policy, Domain, OU, Child OU
5.  Not me
6. I would imagine try it and see for a bit.  Like I said, i've only used what I described as above and it works

kshays
0
TheCleanerCommented:
1.  You should use stratum 2 servers:  http://www.eecis.udel.edu/~mills/ntp/clock2a.html  From what I understand they are more "open" for the public.  (but you can find a list of stratum 1 servers there too)

2.  This is bad practice.   Your workstations and member servers should all sync off the domain controllers, which get their time from the "PDC emulator" DC.  That DC should point to get its time from your router, then the router gets its time from the internet.

3.  you should set the time server like you did "net time /setsntp:" on xp/2000/2003 devices.  No reason to mess with the registry.

4.  GPO settings do override desktop settings.  gpupdate /force will force an update.

5.  Sorry don't use Avaya

6.  Again, see #2's answer
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Cloud Class® Course: Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

isd503Author Commented:
OK, I changed the workstations to gather data from the ADC with the PDC role.  The other ADC is also pointing to the PDC.  I also made this second ADC an NTP server.  Both Windows 2003.  I pointed the PDC to the router and the router to tick.usno.navy.mil.

I cannot be sure the PDC is synching with the router.  I also cannot be sure the router itself is synching with the Navy NTP server.  How do I verify these things?
0
Rant32Commented:
The only thing I've ever needed to do to achieve consistent time, is configure the PDC emulator of the forest root domain with external time sync. Domain members (both servers and clients) by default synchronize according to the domain hierarchy.

I use pool.ntp.org for time syncing. See http://www.pool.ntp.org/zone/@ for a list of available time servers per zone.

For example, in europe: "net time /setsntp:europe.pool.ntp.org" does the trick.
0
TheCleanerCommented:
To verify time sync on the PDC or any workstation.

1.  stop the w32time service (don't know why but you need to)

2.  command prompt

3.  w32tm is the command to test
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.