Microsoft Windows Time service settings in domain and forest – Setup

Welcome to my Microsoft Tips & Tricks section. In this session I will describe how I setup the Time Service settings in my domain/forest.

Time in a Microsoft Windows domain and forest is incredibly important. If time on domain controllers begin to drift off, problems aren’t far away. Why Microsoft haven’t added this check to their Best Practice Analyzer is strange to me. This is one of the first things I check whenever I am troubleshooting Active Directory-related problems. I also do a check of Windows Time Service functionality before I start any new implementations of VMware Horizon View, as a good working time source in a domain and forest is critical. I will cover my VMware Horizon View setup in a later post.

I know that this is basic stuff, and everyone should know this. But more often than not, I see a misconfigured Windows Time service as reason for Active Directory problems. Therefore, I will show below how I set this up in my lab-domain. As a source for my NTP I will use no.pool.ntp.org. Read more about The Network Time Protocol from their website here: http://www.ntp.org/

First, identify the PDC. This can be done from any windows server in the domain. Start a command prompt window, run: “netdom query fsmo”

w32tm-01

As we can see here, the server AD-01.ad.admin.frelab.net has the PDC role in my domain.

Next, login to the pdc and start an administrative command prompt window. The syntax for setting windows time settings are as follows:

“w32tm /config /manualpeerlist:timeserver /syncfromflags:manual /reliable:yes /update”

In my lab it will be:

“w32tm /config /manualpeerlist:no.pool.ntp.org /syncfromflags:manual /reliable:yes /update”

W32Time-01

 

Next, I do a resync and rediscover using this cmd: “w32tm /resync /rediscover”

W32Time-02

 

I restart Windows Time Service in order to apply changes using this cmd: “net stop w32time && net start w32time”W32Time-03

 

I verify the new configuration using this cmd: “w32tm /query /configuration” and “w32tm /query /source”

W32Time-04

 

When I check the Event Viewer I can see that the time service is now advertising as good time source in the domain

W32Time-05

W32Time-06

 

The time service is synchronizing with the correct external time provider

W32Time-07

 

The last thing I will check on ny PDC is the status, using the command: “w32tm /query /status”. Another good test is using the command: “w32tm /monitor”

w32tm-09

 

Finally, I will configure the other domain controllers to sync using the forest/domain time hierarchy. I login to the other DC’s desktop start an administrative command prompt, run the following command: “w32tm /config /syncfromflags:domhier /update

W32Time-08

 

Next, I do a resync and rediscover using this cmd: “w32tm /resync /rediscover”

W32Time-09

 

I restart Windows Time Service in order to apply changes using this cmd: “net stop w32time && net start w32time”

W32Time-09_1

 

I verify the new configuration using this cmd: “w32tm /query /source”

W32Time-10

 

With these small steps, I can now be guaranteed a smooth working Time Service in my domain and forest. No problems with replication or other Active Directory issues can now be related to malfunctioning or misconfigured Windows Time Service.

A BIG thanks to Ace Fekay and his excellent write-up about Configuring the Windows Time Service in an Active Directory Forest – A step by step with a Contingency Plan

Recommended reading from Microsoft: Windows Time Service (W32Time)

 

Microsoft Tips & Tricks section

Disclaimer: Every tips/tricks/posting I have published here, is tried and tested in different it-solutions. It is not guaranteed to work everywhere, but is meant as a tip for other users out there. Remember, Google is your friend and don’t be afraid to steal with pride! Feel free to comment below as needed.

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s