asked on 7/8/2011

AD DC's Timesync out by 6min, despite reporting time is synced

Hi,

We've got 6 sites and 1 DMZ with 2008 Domain Controllers (all Global Catalogs), if I run the command w32tm /monitor /domain:<ourdomain> then it reports that all 6 sites are sync'ed with the DC in the DMZ and that the max time difference is 15ms.

If I physically login to the Domain Controllers (Remote Desktop) then one's time is 6 minutes ahead of the rest of the Domain Controllers. How is this possible if the w32tm /monitor reports that it is in sync with the DC in the DMZ and it is out by 0ms (but in fact it's time is 6 minutes ahead...) ?

Thank you for any assistance in finding the problem and giving me any info. on how to get the Domain Controllers to properly sync time with the DC in the DMZ.

Regards,
Reinhard

Windows Server 2008 Active Directory Networking

Last Comment

Reinhard Rensburg

7/8/2011

Reinhard Rensburg

7/8/2011

ASKER

Hi, Apologies, I just saw something important,

The 0ms delay I saw at the "w32tm /monitor" command was the latency between the DC with the incorrect time and the DC in our DMZ. I see that it shows in the line above it "NTP: +313.2996176s offset from <DC in DMZ.domain name" so it is actually aware of the fact that it's 313 seconds ahead of the DC where it's supposed to get it's time from - what would stop it from then getting the correct time from the DC if it knows that it's time is out?

I see most of our DC's at the other sites are out with approx the same time...

Thanks,
Reinhard

ASKER CERTIFIED SOLUTION

slefebvre1

7/8/2011

THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

See Pricing Options

Start Free Trial

Reinhard Rensburg

7/8/2011

ASKER

Hi slefebvre1,

Thanks for the info.

What I've done in the meantime was to manually set the update source as it seems like the DC's got time from their own BIOS clocks thus creating the issues with time amongst themselves:

The command I used (on the DCs') is:

w32tm /config /manualpeerlist:<name of our PDC Emulator> /syncfromflags:manual /reliable:yes

If I then type in w32tm /query /source it shows the PDC Emulator as the source.

I know my way is manual, so if the PDC Emulator Role is ever moved the DCs will still try and get time from the "old PDC Emulator" as set manually by my command, where as with your solution it will always follow the correct domain hierarchy and update to the actual PDC Emulator as the source should it ever move, so thanks, your info. was valuable.

Regards,
Reinhard.