Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1405
  • Last Modified:

Setting up time synchronization in a Windows 2003 domain

I currently have multiple DC's in my Windows 2003 R2 Domain. DC1 has the PDC role, yet for some reason all of the workstations and servers are using DC2 to synchronize their time with.

I went to the PDC ( DC1 ) and did " net time /setsntp:<external time server name>. It told me that the command completed successfully. I then did a "net time" and got : Current Time at \\DC2 is 7/25/2007 9:04 PM

I want to set it up so that the DC with the PDC role is the main time source and all workstations go to it to get the time. If something has to be configured for the workstations, I would like to set it in a GPO, so that I dont have to worry about workstations possibly getting un-configured ( so to speak ).

Whats baffeling to me is why a non-PDC role server has taken over the time synchronization service.
0
fgarufijr
Asked:
fgarufijr
  • 3
  • 3
1 Solution
 
LauraEHunterMVPCommented:
In an AD domain, time synchronization works in the following manner:

[1] Workstations will receive their time synchronization information from the DC that authenticated them.
[2] Each DC in a particular domain will receive its time synch info from the PDCe of that domain.
[3] In a multi-domain environment, each PDCe will receive its time synch from the PDCe of the forest root domain.
[4] Only the forest root PDCe should be configure to synch to an external time source.

The "net time" command is deprecated and will give you inconsistent results.   Use w32tm instead.
0
 
fgarufijrAuthor Commented:
Laura... Can you give me the w32tm command to run to see what the correct reporting is???

There are two domains in this forest. A Parent and Child Domain. The Parent domain is what I have been speaking of. All the fsmo foles are in the parent domain anyway. Like I said before, DC1 has the PDCe on it, but yet DC2 seems to be reporting ( atleast through 'net time' ) its handing out the synchronization. Even DC1 seems to be getting its time ( atleast through 'net time' ) from DC2.

Appreciate your reply and looking forward to your next one :)

0
 
LauraEHunterMVPCommented:
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/time_w32tm.mspx?mfr=true

w32tm /config /syncfromflags:DOMHIER /update will configure all servers (except for the PDCe in the forest root) to receive time synch data from the AD defaults I describe above.

The following KB describes how to configure the PDCe in the forest root to receive time from an external source: http://support.microsoft.com/kb/816042
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
fgarufijrAuthor Commented:
Ok...

I've followed the document on the PDCe for Configuring the Windows Time service to use an external time source.

I then went to all the other servers and ran "32tm /config /syncfromflags:DOMHIER /update. " I then checked each of the System event logs to ensure that it worked correctly. I will note that the event showed that it was using the PDCe as its time soruce.

Maybe you can help me understand something. Is it suppose to be that the PDCe syncs time with the external time source, all other servers in the domain syncs with the PDCe, and workstation will sync with any of the servers??? Or is it suppose to be that ALL servers and ALL workstation are only suppose to sync with the PDCe??? I'm noticing that the workstations in my network are still not using PDCe for updating its time. If its the first one, then it doesn't matter... If its the second one, then I'm not sure why workstations aren't choosing the PDCe for updates.

Thanks and looking forward to your next reply :)
0
 
LauraEHunterMVPCommented:
I addressed this in an earlier comment.  Time synchronization in AD is hierarchical, organized as follows:

[1] Workstations and member servers will receive their time synchronization information from the DC that authenticated them, whether this is the PDCe for the domain or another DC.
[2] Each DC in a particular domain that is not the PDCe will receive its time synch info from the PDCe of that domain.
[3] In a multi-domain environment, the PDCe in each domain will receive its time synch from the PDCe of the forest root domain.
[4] The forest root PDCe should be configure to synch to an external time source.
0
 
fgarufijrAuthor Commented:
Thank you again! :)
0

Featured Post

Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now