Time Synchronization Windows 2003, 2000, XP to Cisco 2821 Router

Posted on 2006-03-30
Last Modified: 2008-01-09
Yes!  It's time for yet another time sync question...

I have this working in my environment now, but have a few questions.

I modified the Domain Default Policy GPO which works great at the desktop level but seems to have no affect at the server level:

NtpServer x.x.x.x,0x1
Type NTP
CrossSiteSyncFlags 2
ResolvePeerBackoffMinutes 15
ResolvePeerBackoffMaxTimes 7
SpecialPollInterval 3600
EventLogFlags 0

One Windows 2003 servers, I modified the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters) NtpServer and Type strings.  I also typed the NTP Server IP address into the "Date and Time Properties | Internet Time | Server" field and checked "Automatically synchronize..."

On the Windows 2000 servers I used the "net time \\servername /setsntp:x.x.x.x" command and stopped and restarted the W32Time service.

The questions:

1.  What is a good stratus 1 time server IP address I can use?  I'd like to use a DNS name, but am not sure how well that will work from the router.  How can I compare the time at this server to my environment to ensure accuracy?
2.  Why won't the GPO work on the servers?  Can I modify it or create another one to work for them?  I want all devices to NTP off the router.
3.  Are the things I've done as listed above sufficient for the servers?  I still see some discrepancies.
4.  Do GPO settings override the registry settings at the desktop level?  I can still see NTP registry setting that do not match the GPO.
5.  I'd also like to setup our Avaya phone switch to sync with the router.  Anyone done this before?
6.  Can I get consistency throughout my environment using this methodology and without having to buy additional equipment?
Question by:isd503
    LVL 16

    Expert Comment

    I'll attempt to answer a few of the questions.

    1. net time /
    - I currenly use this on my DC to sync the time.  I then have a startup script via GPO for all the workstations/servers to use 'net time \\servername /set /yes'
    2.  Don't see why it doesn't if you do it in a fashion that i've used above.
    3. I've not really done any of this, but I do keep an eye on the time for all the servers to make sure they stay in sync and they haven't gotten out of sync yet.  I may be lucky i'm not sure though, but i've not touched this part in over a year though.
    4. The last GPO that will effect the computer/user will be the child GPO of an OU.  Example of order GPO's will get processed.
    - Local Policy, Domain, OU, Child OU
    5.  Not me
    6. I would imagine try it and see for a bit.  Like I said, i've only used what I described as above and it works

    LVL 23

    Accepted Solution

    1.  You should use stratum 2 servers:  From what I understand they are more "open" for the public.  (but you can find a list of stratum 1 servers there too)

    2.  This is bad practice.   Your workstations and member servers should all sync off the domain controllers, which get their time from the "PDC emulator" DC.  That DC should point to get its time from your router, then the router gets its time from the internet.

    3.  you should set the time server like you did "net time /setsntp:" on xp/2000/2003 devices.  No reason to mess with the registry.

    4.  GPO settings do override desktop settings.  gpupdate /force will force an update.

    5.  Sorry don't use Avaya

    6.  Again, see #2's answer
    LVL 23

    Expert Comment

    LVL 3

    Author Comment

    OK, I changed the workstations to gather data from the ADC with the PDC role.  The other ADC is also pointing to the PDC.  I also made this second ADC an NTP server.  Both Windows 2003.  I pointed the PDC to the router and the router to

    I cannot be sure the PDC is synching with the router.  I also cannot be sure the router itself is synching with the Navy NTP server.  How do I verify these things?
    LVL 12

    Expert Comment

    The only thing I've ever needed to do to achieve consistent time, is configure the PDC emulator of the forest root domain with external time sync. Domain members (both servers and clients) by default synchronize according to the domain hierarchy.

    I use for time syncing. See for a list of available time servers per zone.

    For example, in europe: "net time /" does the trick.
    LVL 23

    Expert Comment

    To verify time sync on the PDC or any workstation.

    1.  stop the w32time service (don't know why but you need to)

    2.  command prompt

    3.  w32tm is the command to test

    Featured Post

    What Should I Do With This Threat Intelligence?

    Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

    Join & Write a Comment

    Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
    On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now