Configure source of time on Domain


Configure time in my Active Directory

  • How to set the PDC ROLE server as the source of time zone on the network
  • How to move PDC role and Time service to another server

How to set the PDC ROLE server as the source of time zone on the Domain

How to set a time source in my domain

First, you must locate the PDC role on your Domain

PDC must be the source of time on your network

And the PDC server can use an external or internal time source

There are 2 ways to do that

 w32tm.exe command-line utility and GPO
We will use the command line utility
To locate your roles
Run the following Query
netdom Query FSMO
List of time external zones.
http://www.pool.ntp.org/en/
The choose your nearest country
I used Egypt as I m living there
http://www.pool.ntp.org/zone/eg
In most cases, it’s best to use pool.ntp.org to find an NTP server (or 0.pool.ntp.org, 1.pool.ntp.org, etc if you need multiple server names). The system will try finding the closest available servers for you. If you distribute software or equipment that uses NTP,
Ok let’s start
ON PDC
Run the following command on your PDC to make sure of your source
w32tm /query /source
By default, the server uses it is local BIOS as the source of time

Now lets set an external source
w32tm /config /manualpeerlist:timeserver, 0x1 /syncfromflags:manual /reliable:yes /update
Remove the TimeServer and add your external one
EX
w32tm /config /manualpeerlist: manualpeerlist:pool.ntp.org,0x1 /syncfromflags:manual /reliable:yes /update
Note: don’t forget to add the 0x1 flag will take later about it
Then again on the PDC
w32tm /query /source
The flags are used as
  • 0 Not a time server
  • 1 Always a time server
  • 2 Automatic time server, meaning the role is decided by Windows Time Service
  • 4 Always a reliable time server
  • 8 Automatic reliable time server, meaning the role is decided by Windows Time Service
The default is 10, meaning that Windows Time Service decides the role.
Ref: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-xp/bb490845(v=technet.10)

On NON-PDC server
Now
Run this to make sure it is working fine
On other servers (non-PDC) we need to make sure they are using the PDC as the source of time
On non-PDC
w32tm /config /syncfromflags:domhier /update
net stop w32time
net start w32time
w32tm /query /source

W32tm /resync
net stop w32time
net start w32time
w32tm /query /source
now you shall see the PDC as the source of time
after running the following
w32tm /resync
To Resynchronize the Client Time with a Time Server
W32tm /resync /rediscover
let us talk about the power shell command how it works
first on the PDC
w32tm /config /manualpeerlist:timeserver, 0x1 /syncfromflags:manual /reliable:yes /update
second on non-PDC
w32tm /config /syncfromflags:domhier /update
/syncfromflags tells the time service where it should sync time from. You can specify two entries for this – either DOMHIER
or MANUAL. The former causes the time service to synchronize with the Domain Hierarchy
(sets NT5DS in the Type key in the registry) whereas the latter tells the time service to sync with the server(s) you specified in the Manual Peer List. MANUAL sets Type to NTP.
DOMHIER uses the NT5DS Protocol
NT5DS: The time service synchronizes from the domain hierarchy.
Manual users the NTP Protocol
NTP: The time service synchronizes from the servers specified in the NtpServer registry entry.
So to make it easier
PDC server MANUAL NTP time.windows.com, 0x1
Non PDC server DOMHIER NT5DS PDC server as the source
To make sure and see the details you can go to the following registry entry on the PDC and the source is external
Protocol is NTP
Cause we us in the command
Manualpeerlist not domhier

Ok
/reliable
sets the server to be a reliable source of time for the domain
Required only on the PDC
/update notifies the time service the values have changed, so the new settings are used with immediate effect
Second how to move PDC role and Time server to another server
Move PDC role
Then you can move the PDC role using the users and computers console
Then make the old PDC unreliable as the source of the time server
old PDC
w32tm /config /syncfromflags:domhier /reliable:no /update
net stop w32time
net start w32time
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s