Windows 2012 R2 Server Event ID 142 and 50 Time Service on DC

Windows 2012 R2 Domain Controller
 
I get these two errors every so often

Log Name:      System
Source:        Microsoft-Windows-Time-Service
Date:          7/1/2015 12:31:28 PM
Event ID:      142
Task Category: None
Level:         Warning
Keywords:      
User:          LOCAL SERVICE
Computer:      SERV011.fqdn.com
Description:
The time service has stopped advertising as a time source because the local clock is not synchronized.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Time-Service" Guid="{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}" />
    <EventID>142</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2015-07-01T16:31:28.388174400Z" />
    <EventRecordID>8141</EventRecordID>
    <Correlation />
    <Execution ProcessID="892" ThreadID="4412" />
    <Channel>System</Channel>
    <Computer>SERV011.fqdn.com</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData Name="TMP_EVENT_STOP_ADVERTISING">
  </EventData>
</Event>


Log Name:      System
Source:        Microsoft-Windows-Time-Service
Date:          7/1/2015 12:31:28 PM
Event ID:      50
Task Category: None
Level:         Warning
Keywords:      
User:          LOCAL SERVICE
Computer:      SERV011.fqdn.com
Description:
The time service detected a time difference of greater than 128 milliseconds for 90 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Time-Service" Guid="{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}" />
    <EventID>50</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2015-07-01T16:31:28.388174400Z" />
    <EventRecordID>8142</EventRecordID>
    <Correlation />
    <Execution ProcessID="892" ThreadID="4412" />
    <Channel>System</Channel>
    <Computer>SERV011.fqdn.com</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData Name="TMP_EVENT_LOCALCLOCK_UNSET">
    <Data Name="TimeDifferenceMilliseconds">128</Data>
    <Data Name="TimeSampleSeconds">90</Data>
  </EventData>
</Event>

So I then do the following

Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Users\administrator>wt32t
'wt32t' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\administrator>w32tm /query /configuration /verbose
[Configuration]

EventLogFlags: 2 (Policy)
AnnounceFlags: 10 (Policy)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 10 (Policy)
MaxPollInterval: 15 (Policy)
MaxNegPhaseCorrection: 54000 (Policy)
MaxPosPhaseCorrection: 54000 (Policy)
MaxAllowedPhaseOffset: 300 (Policy)

FrequencyCorrectRate: 4 (Policy)
PollAdjustFactor: 5 (Policy)
LargePhaseOffset: 1280000 (Policy)
SpikeWatchPeriod: 90 (Policy)
LocalClockDispersion: 10 (Policy)
HoldPeriod: 5 (Policy)
PhaseCorrectRate: 1 (Policy)
UpdateInterval: 30000 (Policy)

FileLogName:  (Undefined or NotUsed)
FileLogEntries:  (Undefined or NotUsed)
FileLogSize: 0 (Undefined or NotUsed)
FileLogFlags: 0 (Undefined or NotUsed)

[TimeProviders]

NtpClient (Local)
DllName: C:\Windows\system32\w32time.DLL (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
CrossSiteSyncFlags: 2 (Policy)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Policy)
ResolvePeerBackoffMaxTimes: 7 (Policy)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 0 (Policy)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (Policy)
Type: NT5DS (Policy)
NtpServer:  (Undefined or NotUsed)

NtpServer (Local)
DllName: C:\Windows\system32\w32time.DLL (Local)
Enabled: 1 (Local)
InputProvider: 0 (Local)
AllowNonstandardModeCombinations: 1 (Local)
EventLogFlags: 0 (Undefined or NotUsed)

VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 0 (Local)
InputProvider: 1 (Local)


C:\Users\administrator>w32tm /resync
Sending resync command to local computer
The command completed successfully.

C:\Users\administrator>

After the resync I get this  which is normal



Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          7/1/2015 12:34:15 PM
Event ID:      1
Task Category: None
Level:         Information
Keywords:      Time
User:          LOCAL SERVICE
Computer:      SERV011.fqdn.com
Description:
The system time has changed to ?2015?-?07?-?01T16:34:15.053000000Z from ?2015?-?07?-?01T16:34:15.053934700Z.

Change Reason: An application or system component changed the time.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>1</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2015-07-01T16:34:15.052214200Z" />
    <EventRecordID>8147</EventRecordID>
    <Correlation />
    <Execution ProcessID="892" ThreadID="4364" />
    <Channel>System</Channel>
    <Computer>SERV011.fqdn.com</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="NewTime">2015-07-01T16:34:15.053000000Z</Data>
    <Data Name="OldTime">2015-07-01T16:34:15.053934700Z</Data>
    <Data Name="Reason">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Time-Service
Date:          7/1/2015 12:34:15 PM
Event ID:      139
Task Category: None
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      SERV011.fqdn.com
Description:
The time service has started advertising as a time source.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Time-Service" Guid="{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}" />
    <EventID>139</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2015-07-01T16:34:15.052294800Z" />
    <EventRecordID>8148</EventRecordID>
    <Correlation />
    <Execution ProcessID="892" ThreadID="4364" />
    <Channel>System</Channel>
    <Computer>SERV011.fqdn.com</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData Name="TMP_EVENT_START_ADVERTISING">
  </EventData>
</Event>

This is a DC1 Windows 2012 R2 Server Has all FSMO Roles and is the PDC
I have another DC2 Windows 2012 R2 Server also which is the NTP server and all network computers have NT5DS set
So does this DC1 have NT5DS set
DC2 has NTP set
I use a GPO to set all the NTP settings
Should I remove DC1 from the GPO and make it a NTP like DC2 or should they both have NT5DS set and not be in the GPO


I hope I explained this ok


Thoughts
LVL 23
Thomas GrassiSystems AdministratorAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AmitIT ArchitectCommented:
Normally, we keep PDC alone as time source server for rest of the DC's. Can you share your GPO settings, I want to see ntp server.
0
Seth SimmonsSr. Systems AdministratorCommented:
two issues here:

Type: NT5DS (Policy)
NtpServer:  (Undefined or NotUsed)


you need to have these set correctly on the server with the PDC emulator role (seems to be DC1)
type should be NTP and ntpserver should be a list of ntp servers DC1 will get time from
each server should be followed by 0x1.  here is how i have mine configured on my test server:

Type: NTP (Local)
NtpServer: 0.north-america.pool.ntp.org,0x1  (Local)


i only have 1 server defined there but you can put 2 or 3 in case 1 is down

here is the article explaining the configuration in the registry:

How to configure an authoritative time server in Windows Server
https://support.microsoft.com/en-us/kb/816042
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Thomas GrassiSystems AdministratorAuthor Commented:
Amit

first thanks for the fast response

I have a WMI Filter for the GPO which is this

Select Name From WIN32_ComputerSystem Where Not Name Like "DC2"

My GPO is attached as an html saved report
NTP-Settings-for-Domain.htm
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

Thomas GrassiSystems AdministratorAuthor Commented:
Seth

If I make DC2 the PDC which is just a simple change does DC1 need any NTP changes?

Can I keep it in the gpo like the rest of my network computers are which is setup with NT5DS
0
Thomas GrassiSystems AdministratorAuthor Commented:
Amit

the last gpo policy report was incorrect here it the correct one


Also from my computer

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\me>w32tm /query /configuration /verbose
[Configuration]

EventLogFlags: 2 (Policy)
AnnounceFlags: 10 (Policy)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 10 (Policy)
MaxPollInterval: 15 (Policy)
MaxNegPhaseCorrection: 54000 (Policy)
MaxPosPhaseCorrection: 54000 (Policy)
MaxAllowedPhaseOffset: 300 (Policy)

FrequencyCorrectRate: 4 (Policy)
PollAdjustFactor: 5 (Policy)
LargePhaseOffset: 1280000 (Policy)
SpikeWatchPeriod: 90 (Policy)
LocalClockDispersion: 10 (Policy)
HoldPeriod: 5 (Policy)
PhaseCorrectRate: 1 (Policy)
UpdateInterval: 30000 (Policy)

FileLogName:  (Undefined or NotUsed)
FileLogEntries:  (Undefined or NotUsed)
FileLogSize: 0 (Undefined or NotUsed)
FileLogFlags: 0 (Undefined or NotUsed)

[TimeProviders]

NtpClient (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
CrossSiteSyncFlags: 2 (Policy)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Policy)
ResolvePeerBackoffMaxTimes: 7 (Policy)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 0 (Policy)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (Policy)
Type: NT5DS (Policy)
NtpServer:  (Undefined or NotUsed)

VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
NtpServer (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 0 (Local)
InputProvider: 0 (Local)


C:\Users\me>
NTP-Settings-for-Domain2.htm
0
Will SzymkowskiSenior Solution ArchitectCommented:
I would highly recommend you take a look at the following link as it explains exactly how you should setup your time source. It also provides diagrams to better understand how it works.

http://blogs.technet.com/b/nepapfe/archive/2013/03/01/it-s-simple-time-configuration-in-active-directory.aspx

The only thing I do differently when I setup my Time source is that I do not configure a GPO for the clients to all point to the PDC. I say this because all of the DC's actually act as time sources for the domain and they get their time from the PDC. So I let the heirachy control the clients/member servers time.

I do this specifically for a couple of reasons...
- take load off the PDC
- latency issues at remote sites
- no no additional configuration required

In the link above it does outline setting a GPO however this is not necessary.

Will.
0
Thomas GrassiSystems AdministratorAuthor Commented:
Will

If I remove the GPO then do a gpupdate /force on all the computers will that remove my Policy settings?

I think I need to remove the GPO first then I can setup the PDC as the Main time source and then all other computers and Server use NT5Ds correct?

If I use NT5DS what to I put in the NTP Server value?
0
Seth SimmonsSr. Systems AdministratorCommented:
If I make DC2 the PDC which is just a simple change does DC1 need any NTP changes?

if you follow the kb article i cited earlier, make those changes on DC2 if it has the PDC role
0
Will SzymkowskiSenior Solution ArchitectCommented:
When you remove the GPO it will then point to the domain controllers at the respective site. Some users will connect to the PDC but other will also use the other DC's in your environment.

You have to make sure that your PDC time source is correct to ensure that the PDC role holder is not using the local BIOS time which will skew the time for other DC's and it is less accurate.

Will.
0
Thomas GrassiSystems AdministratorAuthor Commented:
Everyone

I just made DC2 the PDC

In the articles I made all the changes to DC2 the other day.  They are all good.

 I am going to filter out DC1 from group policy first.

Will post results
0
Thomas GrassiSystems AdministratorAuthor Commented:
Remove the GPO from the Domain.

No all Computers have NT5DS settings when I run w32tm /query /configuration /verbose
Type : NT5DS (Local)
NtpServer: (Undefined or Notified)

No Policy in effect now

I then ran w32tm  /resync /rediscover /nowait

I got a Event ID 37 showing a DC as the time server Both DC1 and DC2 showed
 
Now using Active Directory for Time Service

Will post results over the next 24 hours to see if we see any event id 142 or 50 again
0
Thomas GrassiSystems AdministratorAuthor Commented:
Guys

Was going back thru my event logs today and I found this error


Log Name:      System
Source:        NETLOGON
Date:          7/1/2015 2:21:40 PM
Event ID:      3096
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      SERV011.FQDN.com
Description:
The primary Domain Controller for this domain could not be located.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="NETLOGON" />
    <EventID Qualifiers="0">3096</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-07-01T18:21:40.000000000Z" />
    <EventRecordID>8196</EventRecordID>
    <Channel>System</Channel>
    <Computer>TGCS011.our.network.tgcsnet.com</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>


Not sure of the timing but I believe this happened after I made DC2 the PDC

This message appeared in DC1's event log

Thoughts?
0
Thomas GrassiSystems AdministratorAuthor Commented:
Guys

Time Service seem to be working

The error 3096 was most likely due to moving the PDC role over.

Ran DCDIAG on both DC's found no AD problems

DC2 had some weird DNS results for IP6  not using IPv6  will look into that later.

Thanks
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.