windows 2008 ntp sync issue

hi I am running a windows 2008 domain, but currently all machines are in the default computer container & all have internet access via my asa5505 firewall.

note: current clock time is 14:00 28 sep 2014, so I decided to change to: 13:00 28 sep 2014 - thinking that the below would correct master dc clock via asa5505 set as:

config t
ntp server 192.168.0.254 source inside - this ip address is my internal master dc

----------------------------------------------

just for the purposes of confirming I have the correct configuration I have opened my master dc/ad/dns/dhcp server via its default domain controller container and accessed the gpmc and edited & enabled the following:

computer config/admin template/system/windows time service:
global configuration settings - enabled

computer config/admin template/system/windows time service/time providers:
enable windows ntp server - enabled

step 2

ran: gpupdate & logged off and on

qns1.  I have also rebooted the master dc and the clock has not corrected itself  - why  ?
mikey250Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

mikey250Author Commented:
hi the has changed to the correct time about 30 mins ago.

In order to double check I manually changed the time back 1 hour and waited 15 mins after following the above instructions and the time has not changed back.

I then did the following but still the time has not changed back to the correct time of: 18:07 pm:

 net stop w32time
    w32tm /config /syncfromflags:manual /manualpeerlist:88.143.128.123,0x9,time.windows.com,0x9
    net start w32time
asaconfigs.TXT
0
Ganesh Kumar ASr Infrastructure SpecialistCommented:
Note: ASA can only act as an NTP client, not as a NTP server. Just point the hosts to an external NTP server and let them sync.  

In ASA:
Assuming if ASA is not syncing with the public NTP you need to check if those IP's are reachable, sometimes due to plenty of NTP sessions on public time server, it might have not sync.

In Primary domain controller :
Check the public time server is accessible from your PDC (AD).  
w32tm /? command will give you more set of  option to verify and sync.
Have you set the PDC as time source which i had mentioned in my previous threads.
Also ensure you allow specific ports on the windows firewall as well or it should be disabled.
The above mentioned command will work only on windows not on the ASA.
0
mikey250Author Commented:
hi ganesh,

I have manually set my master dc, back to the correct time ie 4 oct 2014 16:55 pm

on my local switch I added:

config t

int fa0/3
description connected to asa-firewall-eth1
switchport mode trunk
speed 100
duplex full
no shut


question 1

ntp source vlan 1 - currently all my internal lan is on vlan 1.  however I did try vlan 2 but invalid input  ? ?
ntp server 88.149.128.123

sh ntp status via master dc - showing sync to 88.149.128.123 & stratum 3 successfully
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

mikey250Author Commented:
hi ganesh, also I have also added below:

clock timezone cst/gmt -0
clock summer-time recurring

ip default-gateway 192.168.0.1 - points to my asa internal lan
0
Ganesh Kumar ASr Infrastructure SpecialistCommented:
Is it working properly or you are facing issues?
0
mikey250Author Commented:
hi ganesh, apologies for taking a while to return.

- I  can ping the external ntp's successfully
- my asa has sync'd with external ntps successfully
- show ntp status shows this successfully but it also shows 'stratum 3' but was expecting it to be stratum 1 for eg ?
- internal master dc can ping external ntp successfully
- internal master dc clock is also set
- internal master dc is configured:

config t
clock timezone cst/gmt -0  (for the uk I think is correct )  ?
clock summer-time recurring


qns1.  (your previous comments)   -  "asa can only act as an ntp client, not as a ntp server. Just point the hosts to an external ntp server and let them sync."  - surely my asa should be ntp server as below & internal master dc should also be ntp server as below because if my asa went down/faulty then my master dc would act as the ntp server ?

ntp server 192.168.0.x/24 - the reason behind this is the client machines will be set: ntp client etc  ?
ntp server source x.x.x.x (the external ntp)

note: not added authentication at this stage as just confirming above is correct
0
mikey250Author Commented:
hi i was still trying to get a response to my 2 questions below: (??)  

- I  can ping the external ntp's successfully
- my asa has sync'd with external ntps successfully

- show ntp status shows this successfully but it also shows 'stratum 3' but was expecting it to be stratum 1 for eg  ?

- internal master dc can ping external ntp successfully
- internal master dc clock is also set
- internal master dc is configured:

config t
clock timezone cst/gmt -0  (for the uk I think is correct )   ?

clock summer-time recurring
0
Ganesh Kumar ASr Infrastructure SpecialistCommented:
If your ASA is synching and acting as a NTP server fine. You can continue. You cannot expect Stratum 1 server, it is the mostly polled server which might be return or redirected to stratum 3. There is no point in worrying about it. If you have good timesync on your environment and client you wont face issues. Check your time zone whichever it says nearest it syncs. Moreover the NTP client knows how to adjust between the time zones if any NTP client configured to be having different time zone.
0
mikey250Author Commented:
ok thanks for that i wasnt sure.
0
mikey250Author Commented:
sound advice appreciated.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.