We help IT Professionals succeed at work.

Time Synchronization Windows 2003, 2000, XP to Cisco 2821 Router

isd503
isd503 asked
on
Medium Priority
1,709 Views
Last Modified: 2008-01-09
Yes!  It's time for yet another time sync question...

I have this working in my environment now, but have a few questions.

I modified the Domain Default Policy GPO which works great at the desktop level but seems to have no affect at the server level:

NtpServer x.x.x.x,0x1
Type NTP
CrossSiteSyncFlags 2
ResolvePeerBackoffMinutes 15
ResolvePeerBackoffMaxTimes 7
SpecialPollInterval 3600
EventLogFlags 0

One Windows 2003 servers, I modified the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters) NtpServer and Type strings.  I also typed the NTP Server IP address into the "Date and Time Properties | Internet Time | Server" field and checked "Automatically synchronize..."

On the Windows 2000 servers I used the "net time \\servername /setsntp:x.x.x.x" command and stopped and restarted the W32Time service.

The questions:

1.  What is a good stratus 1 time server IP address I can use?  I'd like to use a DNS name, but am not sure how well that will work from the router.  How can I compare the time at this server to my environment to ensure accuracy?
2.  Why won't the GPO work on the servers?  Can I modify it or create another one to work for them?  I want all devices to NTP off the router.
3.  Are the things I've done as listed above sufficient for the servers?  I still see some discrepancies.
4.  Do GPO settings override the registry settings at the desktop level?  I can still see NTP registry setting that do not match the GPO.
5.  I'd also like to setup our Avaya phone switch to sync with the router.  Anyone done this before?
6.  Can I get consistency throughout my environment using this methodology and without having to buy additional equipment?
Comment
Watch Question

Kevin HaysIT Analyst
CERTIFIED EXPERT

Commented:
I'll attempt to answer a few of the questions.

1. net time /setsntp:tick.usno.navy.mil
- I currenly use this on my DC to sync the time.  I then have a startup script via GPO for all the workstations/servers to use 'net time \\servername /set /yes'
2.  Don't see why it doesn't if you do it in a fashion that i've used above.
3. I've not really done any of this, but I do keep an eye on the time for all the servers to make sure they stay in sync and they haven't gotten out of sync yet.  I may be lucky i'm not sure though, but i've not touched this part in over a year though.
4. The last GPO that will effect the computer/user will be the child GPO of an OU.  Example of order GPO's will get processed.
- Local Policy, Domain, OU, Child OU
5.  Not me
6. I would imagine try it and see for a bit.  Like I said, i've only used what I described as above and it works

kshays
1.  You should use stratum 2 servers:  http://www.eecis.udel.edu/~mills/ntp/clock2a.html  From what I understand they are more "open" for the public.  (but you can find a list of stratum 1 servers there too)

2.  This is bad practice.   Your workstations and member servers should all sync off the domain controllers, which get their time from the "PDC emulator" DC.  That DC should point to get its time from your router, then the router gets its time from the internet.

3.  you should set the time server like you did "net time /setsntp:" on xp/2000/2003 devices.  No reason to mess with the registry.

4.  GPO settings do override desktop settings.  gpupdate /force will force an update.

5.  Sorry don't use Avaya

6.  Again, see #2's answer

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

Author

Commented:
OK, I changed the workstations to gather data from the ADC with the PDC role.  The other ADC is also pointing to the PDC.  I also made this second ADC an NTP server.  Both Windows 2003.  I pointed the PDC to the router and the router to tick.usno.navy.mil.

I cannot be sure the PDC is synching with the router.  I also cannot be sure the router itself is synching with the Navy NTP server.  How do I verify these things?

Commented:
The only thing I've ever needed to do to achieve consistent time, is configure the PDC emulator of the forest root domain with external time sync. Domain members (both servers and clients) by default synchronize according to the domain hierarchy.

I use pool.ntp.org for time syncing. See http://www.pool.ntp.org/zone/@ for a list of available time servers per zone.

For example, in europe: "net time /setsntp:europe.pool.ntp.org" does the trick.
To verify time sync on the PDC or any workstation.

1.  stop the w32time service (don't know why but you need to)

2.  command prompt

3.  w32tm is the command to test
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.