Microsoft Windows Time service settings in domain and forest – Setup

Release date: January 11th 2019

Welcome to my Microsoft Tips & Tricks section. In this session I will describe how I setup the Time Service settings in my domain/forest.

Time in a Microsoft Windows domain and forest is incredibly important. If time on domain controllers begin to drift off, problems aren’t far away. Why Microsoft haven’t added this check to their Best Practice Analyzer is strange to me. This is one of the first things I check whenever I am troubleshooting Active Directory-related problems. I also do a check of Windows Time Service functionality before I start any new implementations of VMware Horizon View, as a good working time source in a domain and forest is critical. I will cover my VMware Horizon View setup in a later post.

I know that this is basic stuff, and everyone should know this. But more often than not, I see a misconfigured Windows Time service as reason for Active Directory problems. Therefore, I will show below how I set this up in my lab-domain. As a source for my NTP I will use no.pool.ntp.org. Read more about The Network Time Protocol from their website here: http://www.ntp.org/

First, identify the PDC. This can be done from any windows server in the domain. From an administrative command prompt run the following command:

netdom query fsmo
w32tm-01

As we can see here, the server AD-01.ad.admin.frelab.net has the PDC role in my domain.

Next, login to the pdc and start an administrative command prompt window. The syntax for setting windows time settings are as follows:

w32tm /config /manualpeerlist:timeserver /syncfromflags:manual /reliable:yes /update

In my lab it will be:

w32tm /config /manualpeerlist:no.pool.ntp.org /syncfromflags:manual /reliable:yes /update
W32Time-01

Next, I do a resync and rediscover…

w32tm /resync /rediscover
W32Time-02
W32Time-03

I restart Windows Time Service in order to apply changes…

net stop w32time && net start w32time

I verify the new configuration…

w32tm /query /configuration" and "w32tm /query /source
W32Time-04

When I check the Event Viewer I can see that the time service is now advertising as good time source in the domain

W32Time-05
W32Time-06

The time service is synchronizing with the correct external time provider

W32Time-07

The last thing I will check on ny PDC is the status…

w32tm /query /status
w32tm /monitor
w32tm-09

Finally, I will configure the other domain controllers to sync using the forest/domain time hierarchy. I login to the other DC’s desktop start an administrative command prompt, run the following command:

w32tm /config /syncfromflags:domhier /update
W32Time-08

Next, I do a resync and rediscover

w32tm /resync /rediscover
W32Time-09

I restart Windows Time Service in order to apply changes…

net stop w32time && net start w32time
W32Time-09_1

I verify the new configuration…

w32tm /query /source
W32Time-10

With these small steps, I can now be guaranteed a smooth working Time Service in my domain and forest. No problems with replication or other Active Directory issues can now be related to malfunctioning or misconfigured Windows Time Service.

A BIG thanks to Ace Fekay and his excellent write-up about Configuring the Windows Time Service in an Active Directory Forest – A step by step with a Contingency Plan

Recommended reading from Microsoft: Windows Time Service (W32Time)

Microsoft Tips & Tricks section

Disclaimer: Every tips/tricks/posting I have published here, is tried and tested in different it-solutions. It is not guaranteed to work everywhere, but is meant as a tip for other users out there. Remember, Google is your friend and don’t be afraid to steal with pride! Feel free to comment below as needed.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: