Link to home
Start Free TrialLog in
Avatar of jhyanagi
jhyanagiFlag for United States of America

asked on

TIimezone/Time GPO issues

Hello,

l am trying to run a GPO on all domain computers (all xp pro sp3) that will do the following via vbscript: time sync with one of our DC's (2k3 sp2), change the timezone, and offset the time.

I have manually tested each script, and they work fine. The problem is with getting the GPO to run all 3. The scripts are stored in a netlogon folder.

I have tried setting this up as startup scripts, but the scripts do not run.In some places,  I have read that the local system account does not have access to network resources. In others, I have read that giving Domain Computers Read/Execute permissions should allow the system account access. I have tried that method, but no dice. Eventvwr shows the following error: Source: Userinit Error ID: 1000 Could not execute \\<domain controller>\netlogon\*.vbs. Access is denied. Is there somewhere else, other than the folders/files, that I need to give Domain Computers permissions?

I have also tried running these as logon scripts. I changed the system configurations to allow standard users to change their system time, however, I have not found an option in GPM to allow the standard user to change timezone.   So, this method isn't doing it for me either.

I have read of other ways to make this work, such as: setting the logon scripts to run-as, building an msi, etc. I am not very experienced with GPO's, or vbscript so any suggestions on how to properly create this GPO would be appreciate. I prefer the easy way out, other than going to each machine and running these scripts manually.

Thanks in advance for the help.
Avatar of RichardWltenburg
RichardWltenburg
Flag of Netherlands image

on your DC (needs to be the one with PDC Emulator. (find in ADUC right click on your domain then Operation Masters)

Use in command "w32tm /query /status" (without the """ )  to see what is status.

log on to the server with the PDC emulator.

command:
w32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:yes /update
net stop w43time
net start w43time
now when a computer is connected to the domein it will automaticly get the time.

in canse settings were changed on a client you can change it by

w32tm /config /syncfromflags:domhier /update
net stop w32time
net start w32time


to resync the time:
w32tm /resync

hope this will work. make sure port 123 (NTP) is open on firewalls.

Avatar of jhyanagi

ASKER

Thanks for the response..

Will this sync the time for computers already on the domain, or is it just for newly added machines?

Also, I'm not sure that this is completely what I'm looking for. I only need to sync the computers to the DC so that every computer will have a baseline. This way, I only need one script to change the timezone, etc.

This would work for the sync part, but that still leaves me with the timezone change and time offset.
 
yes also computers in the domain,
computers will sync with the DC and dc in this case with timeserver.

problem with script is that it only runs when computer starts, and users can change it.


else for gpo
http://www.buchatech.com/2009/04/configure-windows-ntp-client-gpo/
I wish it were this easy...

My servers will be set to a completely different timezone and time from my computers. I know this sounds weird, but thats how it's being set up since. I know they have to be within 5 minutes of the DC to work correctly, but it works doing it this way. Maybe this is also what the time sync is for?
yes that sounds weird. in the past we used the GPO, but more often the time wasnt correct. since we used the w32tm everything is working just fine..

hope you can fix your problem.
thanks for the help
ASKER CERTIFIED SOLUTION
Avatar of RichardWltenburg
RichardWltenburg
Flag of Netherlands image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Rgr.
and did it work?