Solved

Windows 2003 Domain time incorrect

Posted on 2009-04-14
28
491 Views
Last Modified: 2012-05-06
I have tried to follow the below directions to get our time synchronized to a public time server, but our time is still off by about 5-6 minutes, this is causing people to be late to meetings etc.  What am I possibly missing that would make it wrong??  (all of our computers show the same time, which is good, but it is wrong):

http://www.windowsnetworking.com/articles_tutorials/Configuring-Windows-Time-Service.html

All of our servers are Windows 2003 Server & all of our clients are Windows XP.
0
Comment
Question by:rustyrpage
  • 15
  • 8
  • 4
  • +1
28 Comments
 
LVL 6

Expert Comment

by:univision-computers
ID: 24143174
First, there may be a time zone update for the 2009 changes.  Check update.microsoft.com for any manual updates.

Next, I use a program called atomic clock sync (available from Download.com) - There are a few imitators, but the one I use has a gold ring as the icon once it is installed.  That keeps your server updated regardless of the other time zone settings.
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24143186
If it were a time zone update we would be off by hours, not minutes....our servers are up to date though.

OUr domain controllers are set up to be able to sync with a NIST server, I would like to know why that is not working.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24143730
If you import this reg file it will automatically configure your PDC to use an external time source but make sure you import on the PDC emulator. Are any of these servers or computers running virtually?

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_23630502.html
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24149492
What resync command would I use to verify that it fixed it?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24150085
Run w32tm /resync /rediscover/
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24150259
Yeah, even after doing that we are off by 5 minutes....
0
 
LVL 6

Expert Comment

by:univision-computers
ID: 24150506
Are there any errors in the event viewer about the inability to retrieve the info from the time servers?


0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24150537
Just saw this:

Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source.  It is recommended that you either configure a reliable time service in the root domain, or manually configure the PDC to synchronize with an external time source.  Otherwise, this machine will  function as the authoritative time source in the domain hierarchy.  If an external  time source is not configured or used for this computer, you may choose to disable  the NtpClient.
0
 
LVL 6

Expert Comment

by:univision-computers
ID: 24150618
There are some good tips on this forum: http://www.msfn.org/board/lofiversion/index.php/t67060.html
0
 
LVL 6

Accepted Solution

by:
univision-computers earned 500 total points
ID: 24150638
Also a word Doc here: http://www.mmmug.co.uk/files/216/download.aspx

Step Number 15 on Page 13:

15. Check the Default Domain Controllers group policy and the Default Domain group policy and any others that could affect the PDCe or other DCs. Check the following areas:

Computer configuration/Administrative Templates /System/Windows Time service/Time Providers

      Ensure that all three settings listed are set to not configured.
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24150766
Where is the default domain controllers gpo?
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24150829
Sorry-  that was a stupid question, I figured it out - will test & let you know.
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24150867
How quickly should the change take place?
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24150881
I now have w32time events saying:

The time provider NtpClient is currently receiving valid time data from tock.usno.navy.mil (ntp.m|0x1|10.1.1.50:123->192.5.41.41:123).

However, our time still is off by 4 minutes...
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24150992
Did you import the reg file I posted within that post. This will configure all of your settings for you.
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24151026
Okay - I hadn't restarted the Time service - now the PDC Emulator is pretty close to correct (about 30 second off according to Verizon & http://www.time.gov).  However, my PCs throughout the domain are still in-accurate.  Why aren't they udpating?  I did Run w32tm /resync /rediscover/ on my workstation
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24151059
Looking at my w32time entries on my local machine it looks like I am syncing to several different domain controllers on the network or even non-domain controllers...what did I do wrong now?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24152384
You can set a GPO up that will make the clients point to the PDC for time. Restart the time service on the client.

http://www.windowsnetworking.com/articles_tutorials/Configuring-Windows-Time-Service.html
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24152392
It just started working on it's own...maybe a time delay (no pun intended)
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24153744
Once you have changed the settings it takes a little bit to sync but once you run the command above it is suppose to sync right a way but I have seen it take a little while
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24158212
Well - we are good to go!  Thanks!
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24158226
Wait, maybe I spoke a little too soon!  The laptops that go home at night go back to the old time when they are off the network & then they seem to stay that way for a while.....
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24159877
That is because they update. You can set the laptops profiles up so when they go home the logon witha different profile to allow them to sync to external time source. Or you can set them to directly get the external time from the same source the server is getting it from.
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24159977
So it cannot just maintain its own time when they are off network & then update accordingly?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24160189
If it is part of the domain and it is using the domain profile to logon it will look for the domain to get it's time.
0
 
LVL 6

Author Comment

by:rustyrpage
ID: 24160198
But once I take it off the network here, I lose the domain time & it goes back 4-5 minutes.....that will cause some issues with our log requirements etc.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24160711
If you don't have many laptops you go into there BIOS and change the time there to make sure it matches up with the domain. You can also set the laptops to get the time from the same source the PDC is getting it from.

http://support.microsoft.com/kb/314054
0
 
LVL 38

Expert Comment

by:ChiefIT
ID: 24165103
The way the time service works is your PDCe is the time provider for the domain by default. The PDCe has time synchronization flags to tell all the clients and other servers it is the time server. Those synchronization flags also have a phase offset that tell the clients how close to accurate time they are suppose to be. By default the phase offset is +/- 5 minutes. If you wish to change the phase offset you will have to create a GPO making your PDCe the ""Authoritative Time Server". The +/- 5 minutes keeps the clients within a tolerance to not slow your network down. Otherwise, the client can be up to but not exceeding +/- 5 minutes before the client resynchs with the PDCe. When creating this GPO, do not include the PDCe or it will override any default settings and the PDCe will synchronize with itself, (causing some time errors).


The PDCe will have to point to an outside server, as you already discovered. To make this easy, you can download a program called Symtime. That will synchronize your PDCe with an outside time source without having to go through all the hastle of registry edits, GPOs or anything else.

Symmetricom also offers another program that checks your domain for accuracy for you. So, you don't have to walk around and check the time synchronization. This program is called , (I think), LMcheck.

Both LMcheck and symmtime are free and painless to set up.

Please do not accredit me for this answer. You found the information you were looking for with the other experts. This is just additional information.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

A quick step-by-step overview of installing and configuring Carbonite Server Backup.
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now