Ron Dokken
asked on
Take control over Windows Time Syncronisation
I have a domain, MYDOMAIN.
It has a domain controller, MYDC. (Win 2012)
MYDC does not have an external clock and it's ok if it's 5 minutes off.
Then we have member computers - COMPUTER1, COMPUTER2, COMPUTER3. (Win 2012 / Win 7)
It's a small domain. Only one forest.
What I want is that the member computers are gonna have the same time as MYDC.
They have "Type"=NT5DS. (domain sync)
It kind of works, but not reliably.
Furthermore, I want to be able to manually adjust the clock on the DC, and the member computers are then going to adjust within a time limit (say 20 min).
The problem is that they behave differently - despite having the same settings for W32Time as far as I can see.
I want to have control over the parameters so that you can say that if the DC time is adjusted this way and the time difference is x - then that will happen within y minutes.
A readable article on the subject is this:
https://nchrissos.wordpress.com/2013/04/26/configuring-time-on-windows-2008-r2-servers/
Parameters on DC?
Parameters on member computer?
Is it possible?
Possible to use Group Policy?
Local Policy?
Edit registry settings directly?
It has a domain controller, MYDC. (Win 2012)
MYDC does not have an external clock and it's ok if it's 5 minutes off.
Then we have member computers - COMPUTER1, COMPUTER2, COMPUTER3. (Win 2012 / Win 7)
It's a small domain. Only one forest.
What I want is that the member computers are gonna have the same time as MYDC.
They have "Type"=NT5DS. (domain sync)
It kind of works, but not reliably.
Furthermore, I want to be able to manually adjust the clock on the DC, and the member computers are then going to adjust within a time limit (say 20 min).
The problem is that they behave differently - despite having the same settings for W32Time as far as I can see.
I want to have control over the parameters so that you can say that if the DC time is adjusted this way and the time difference is x - then that will happen within y minutes.
A readable article on the subject is this:
https://nchrissos.wordpress.com/2013/04/26/configuring-time-on-windows-2008-r2-servers/
Parameters on DC?
Parameters on member computer?
Is it possible?
Possible to use Group Policy?
Local Policy?
Edit registry settings directly?
The client settings should remain in their default settings... computers that are members of an AD Domain will always look to DCs for time sync. Specifically, the DC that holds the PDC Role in your forest root domain should be configured to sync with an external (off-server, in your network or outside your network) time service. Below is a decent article about time in an AB domain:
Link: https://social.technet.microsoft.com/Forums/windowsserver/en-US/043b1ebe-e7bc-40ca-91e0-174a6854808e/time-sync-best-practices?forum=winserverDS
So, on the DC holding the PDC Role, you should set up the Time Service to point to an external time service (NTP Service).
If you have your own NTP servers running, point the Forest PDC Role holder to these servers.
If you do not have your own private NTP servers, my suggestion is to use the publically available NTP Pool Servers at http://www.pool.ntp.org.
Under the section "Active Servers" click thru your region and then to time servers that are local to your time zone. I suggest using 2 of the pool alias in your configuration.
For example, in North America, you could use 2 of the following hostnames:
0.north-america.pool.ntp.o
1.north-america.pool.ntp.o
Or in Europe:
0.europe.pool.ntp.org
1.europe.pool.ntp.org
You can always drill down and use a country specific set if you desire:
0.de.pool.ntp.org
1.de.pool.ntp.org
As for simplifying your configuration, yes, you could use GPO to control the Time Service configuration. This configuration has been discussed and resolved on EE in the past. Below is a link that describes the steps necessary to do this:
Link: https://www.experts-exchange.com/questions/27842792/Timeserver-on-DOMAIN-using-GPO.html
Dan
Link: https://social.technet.microsoft.com/Forums/windowsserver/en-US/043b1ebe-e7bc-40ca-91e0-174a6854808e/time-sync-best-practices?forum=winserverDS
So, on the DC holding the PDC Role, you should set up the Time Service to point to an external time service (NTP Service).
If you have your own NTP servers running, point the Forest PDC Role holder to these servers.
If you do not have your own private NTP servers, my suggestion is to use the publically available NTP Pool Servers at http://www.pool.ntp.org.
Under the section "Active Servers" click thru your region and then to time servers that are local to your time zone. I suggest using 2 of the pool alias in your configuration.
For example, in North America, you could use 2 of the following hostnames:
0.north-america.pool.ntp.o
1.north-america.pool.ntp.o
Or in Europe:
0.europe.pool.ntp.org
1.europe.pool.ntp.org
You can always drill down and use a country specific set if you desire:
0.de.pool.ntp.org
1.de.pool.ntp.org
As for simplifying your configuration, yes, you could use GPO to control the Time Service configuration. This configuration has been discussed and resolved on EE in the past. Below is a link that describes the steps necessary to do this:
Link: https://www.experts-exchange.com/questions/27842792/Timeserver-on-DOMAIN-using-GPO.html
Dan
ASKER
The picture in this link is broken
http://www.buchatech.com/2009/04/configure-windows-ntp-client-gpo/
What does it say?
http://www.buchatech.com/2009/04/configure-windows-ntp-client-gpo/
What does it say?
I don't see any broken image links. I would read thru the MSDN articles since they give great visual examples and explain the configuration and its rational.
Dan
Dan
*NO POINTS*
The instructions I posted in this previous EE PAQ, http:/Q_28597899.html#a40553961, do include images to assist in streamlining the process.
And this previous EE PAQ has a good discussion concerning Time Synchronization in AD: http:/Q_28646908.html
-saige-
The instructions I posted in this previous EE PAQ, http:/Q_28597899.html#a40553961, do include images to assist in streamlining the process.
And this previous EE PAQ has a good discussion concerning Time Synchronization in AD: http:/Q_28646908.html
-saige-
ASKER CERTIFIED SOLUTION
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
Watch this micro video tutorial in Expert Exchange : https://www.experts-exchange.com/videos/511/Windows-Server-2012-Configuring-NTP-Servers-for-Time-Synchronization.html
Setup Client GPO is here : http://www.buchatech.com/2009/04/configure-windows-ntp-client-gpo/
Configure Time server : https://support.microsoft.com/en-us/kb/816042#method2