Time Synchronization Windows 2003, 2000, XP to Cisco 2821 Router

Posted on 2006-03-30
Medium Priority
Last Modified: 2008-01-09
Yes!  It's time for yet another time sync question...

I have this working in my environment now, but have a few questions.

I modified the Domain Default Policy GPO which works great at the desktop level but seems to have no affect at the server level:

NtpServer x.x.x.x,0x1
Type NTP
CrossSiteSyncFlags 2
ResolvePeerBackoffMinutes 15
ResolvePeerBackoffMaxTimes 7
SpecialPollInterval 3600
EventLogFlags 0

One Windows 2003 servers, I modified the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters) NtpServer and Type strings.  I also typed the NTP Server IP address into the "Date and Time Properties | Internet Time | Server" field and checked "Automatically synchronize..."

On the Windows 2000 servers I used the "net time \\servername /setsntp:x.x.x.x" command and stopped and restarted the W32Time service.

The questions:

1.  What is a good stratus 1 time server IP address I can use?  I'd like to use a DNS name, but am not sure how well that will work from the router.  How can I compare the time at this server to my environment to ensure accuracy?
2.  Why won't the GPO work on the servers?  Can I modify it or create another one to work for them?  I want all devices to NTP off the router.
3.  Are the things I've done as listed above sufficient for the servers?  I still see some discrepancies.
4.  Do GPO settings override the registry settings at the desktop level?  I can still see NTP registry setting that do not match the GPO.
5.  I'd also like to setup our Avaya phone switch to sync with the router.  Anyone done this before?
6.  Can I get consistency throughout my environment using this methodology and without having to buy additional equipment?
Question by:isd503
LVL 16

Expert Comment

by:Kevin Hays
ID: 16338446
I'll attempt to answer a few of the questions.

1. net time /setsntp:tick.usno.navy.mil
- I currenly use this on my DC to sync the time.  I then have a startup script via GPO for all the workstations/servers to use 'net time \\servername /set /yes'
2.  Don't see why it doesn't if you do it in a fashion that i've used above.
3. I've not really done any of this, but I do keep an eye on the time for all the servers to make sure they stay in sync and they haven't gotten out of sync yet.  I may be lucky i'm not sure though, but i've not touched this part in over a year though.
4. The last GPO that will effect the computer/user will be the child GPO of an OU.  Example of order GPO's will get processed.
- Local Policy, Domain, OU, Child OU
5.  Not me
6. I would imagine try it and see for a bit.  Like I said, i've only used what I described as above and it works

LVL 23

Accepted Solution

TheCleaner earned 1500 total points
ID: 16338471
1.  You should use stratum 2 servers:  http://www.eecis.udel.edu/~mills/ntp/clock2a.html  From what I understand they are more "open" for the public.  (but you can find a list of stratum 1 servers there too)

2.  This is bad practice.   Your workstations and member servers should all sync off the domain controllers, which get their time from the "PDC emulator" DC.  That DC should point to get its time from your router, then the router gets its time from the internet.

3.  you should set the time server like you did "net time /setsntp:" on xp/2000/2003 devices.  No reason to mess with the registry.

4.  GPO settings do override desktop settings.  gpupdate /force will force an update.

5.  Sorry don't use Avaya

6.  Again, see #2's answer
LVL 23

Expert Comment

ID: 16338477
Restore individual SQL databases with ease

Veeam Explorer for Microsoft SQL Server delivers an easy-to-use, wizard-driven interface for restoring your databases from a backup. No expert SQL background required. Web interface provides a complete view of all available SQL databases to simplify the recovery of lost database


Author Comment

ID: 16339814
OK, I changed the workstations to gather data from the ADC with the PDC role.  The other ADC is also pointing to the PDC.  I also made this second ADC an NTP server.  Both Windows 2003.  I pointed the PDC to the router and the router to tick.usno.navy.mil.

I cannot be sure the PDC is synching with the router.  I also cannot be sure the router itself is synching with the Navy NTP server.  How do I verify these things?
LVL 12

Expert Comment

ID: 16340401
The only thing I've ever needed to do to achieve consistent time, is configure the PDC emulator of the forest root domain with external time sync. Domain members (both servers and clients) by default synchronize according to the domain hierarchy.

I use pool.ntp.org for time syncing. See http://www.pool.ntp.org/zone/@ for a list of available time servers per zone.

For example, in europe: "net time /setsntp:europe.pool.ntp.org" does the trick.
LVL 23

Expert Comment

ID: 16343032
To verify time sync on the PDC or any workstation.

1.  stop the w32time service (don't know why but you need to)

2.  command prompt

3.  w32tm is the command to test

Featured Post

Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
With just a little bit of  SQL and VBA, many doors open to cool things like synchronize a list box to display data relevant to other information on a form.  If you have never written code or looked at an SQL statement before, no problem! ...  give i…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question