Adjust time in your server park.

Marganz
Marganz used Ask the Experts™
on
I'm having trouble to find out the do's and dont's for changing the time on your servers in the network.

A few months ago i needed to change the time settings, per accident  the server went 3 mothns back in time and all the other servers and workstations where going nuts, replication errors, password errors etc etc.

Now the time is still not right, need to be adjusted  +5 minutes . because the server is wrong on the time al the workstations are wrong and everyone is complaining about that. so i need to know how to adjust the time and what is possible or not.

We are having a windows server park. Or domain controllers are running Windows Server 2003 (dc01,dc02,dc03,dc04)  the fileserver is running also Server 2003. and the exchange is running windows server 2008.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012

Commented:
change the time on your DC1 rest of servers/clients should pull from it. % minutes by default is Kerberos tolerance. If difference is bigger than 5 minutes, you won't be able to log on to the domain.

Regards,
Krzysztof
on your DC (needs to be the one with PDC Emulator. (find in ADUC right click on your domain then Operation Masters)

Use in command "w32tm /query /status" (without the """ )  to see what is status.

log on to the server with the PDC emulator.

command:
w32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:yes /update
net stop w43time
net start w43time
now when a computer is connected to the domein it will automaticly get the time.

in case settings were changed on a client you can change it by

w32tm /config /syncfromflags:domhier /update
net stop w32time
net start w32time


to resync the time:
w32tm /resync

hope this will work. make sure port 123 (NTP) is open on firewalls.
oops typo in my copy.  it should be net stop/start  w32time instead of w43time.
Build an E-Commerce Site with Angular 5

Learn how to build an E-Commerce site with Angular 5, a JavaScript framework used by developers to build web, desktop, and mobile applications.

Author

Commented:
So to be safe you better change the time first only 3 minutes. then you wait that the new time is updated everywhere. later on you can change it again with 2 minutes. Is his correct?

What is going to happen with systems that will not be on  on the moment that you change the time? Or will not be on in the comming let's say three week?

Author

Commented:
Richard,

the command: w32tm /query /status you can use on any machine to see where it gets its time information right?

That already should be configured  on all the systems. So then we just go to the DC01 what should be the PDC server as well and then just change the time within windows. Max 5 minutes so to be safe just take an maxium of 3 minutes and change the time?

the time will automaticly go to the other servers and systems.? How long will it take?
with "w32tm /query /status" you can see if the computer is syncing with the time server. (just a status report, no harm doing this)

when you restart the "windows time" service it should replicate immediatly
if you follow this steps it should be ok.

change the time on your DC (PDC Emulator) to the correct time.

on your DC (needs to be the one with PDC Emulator. (find in ADUC right click on your domain then Operation Masters)
log on to the server with the PDC emulator.

command:
w32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:yes /update
net stop w32time
net start w32time
now when a computer is connected to the domein it will automaticly get the time.

when the isnt syncing to member servers etc you can do the net stop and start also on that machine(s)

Author

Commented:
w32tm /query /status gave me on my windows 7 machine the information but because i'm not in the network where we are having the problems i used the xp machine from one of the users. but xp is not understandig the same command.

I did an w32tm /monitor WITH THE FOLLOWING RESULT.

C:\>w32tm /monitor
dc01.***.LOCAL *** PDC *** [10.100.200.***]:
    ICMP: 76ms delay.
    NTP: +0.0000000s offset from dc01.***.LOCAL
        RefID: 'LOCL' [76.79.67.**]
dc02.***.LOCAL [10.100.201.***]:
    ICMP: 0ms delay.
    NTP: -0.0070908s offset from dc01.***.LOCAL
        RefID: dc01.***.LOCAL [10.100.200.***]
DC03.***.LOCAL [10.100.202.***]:
    ICMP: error IP_REQ_TIMED_OUT - no response in 1000ms
    NTP: error ERROR_TIMEOUT - no response from server in 1000ms
DC04.***.LOCAL [10.100.203.***]:
    ICMP: 1080ms delay.
    NTP: +0.0358664s offset from dc01.***.LOCAL
        RefID: dc01.***.LOCAL [10.100.200.***]



So DC01 is the PDC time machine.
NTP + or - is giving the information how much time there is between the different servers?

If i will change the time on DC01 the other servers (and computers) will automaticly sync again ?
it will automatically sync with all computers and servers connected in your domain. so stand alone pc's wont automatically update.

Author

Commented:
When i have the time i will adjust the time on the DC01 with less then 5 minuts and let you know how that turned out.

Commented:
You could always add the nist.gov time server to your dhcp scope configurations and domain controllers.

That keeps your network time in sync with the outside world, just a serving suggestion.

Author

Commented:
The systems are allready syncing but, the main server has the wrong time, so all the other machines have the wron time as well.. So we need to adjust the time on the DC01 ( the pfc). with maxium steps of 3 min. how long wil it take to let the machines sync. The problem is the dc01 and exchaneg are on a different location connected trough sdsl. dc02 and fs01 are on ouhr office with about 20 laptops, and we have to dc03 and dc04 and 10 other dekstops an vsat conenction to the middel east.

so what is we change time and the other system is offline or laptop's are not online? probably one big mess and a lot of peopl'es not able to logon anymore?
Top Expert 2012

Commented:
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial