Time Sync with AD

[mlocurci]

We just changed to AD and for years been syncing all of our PC clocks with our WINS server via the login script and the command net time. I am told now by the helpdesk that clock sync is handled diffrently in AD, but no one can provide me a good explanation. I ran a test of changing the clock dramaticly, the clock was fixed at logon. I change the clock by 4 minutes, it didn't adjust. What in AD or Win2004 controls that? Does anyone know where I can find more information? Its very important for all PC clocks to be near close in sync with our servers because of one of our applications controls workforce.

Thanks!

 

[gmail2]

Its very important for all PC clocks to be near close in sync with our servers because of one of our applications controls workforce

It's very important for the client PC's to sync anyway If they're any more than a few minutes out (I think maybe 5 but not too sure) then they won't be able to access shared resources on the server and I beleive users woudln't be able to authenticate either.

As for how the whole time thing works - in your domain one of the Domain Controllers will act as a PDC emulator. This server is the "root" of all time in your domain so you should probably set it to sync from an external source like so

net time /setsntp:time.windows.com

or some other extrnal source (ensure that port 123 is open to that source from the server on your network). To find out where the server is currently pointing to use the querysntp switch of the net time command. The restart the time service and the server is syncing correctly. You can test by changing the time by a few minutes and then at the command prompt entering w32tm /resync - the time should change back then.

Now that the "root" of the time source on you domain is sorted it's pretty straight forward - all other domain controllers will sync from your PDCE and client PC's will sync from any domain controller. You don't need to do anything on the client side for this - once you join the PC to the domain it happens automatically. To check what time sources are available to the client type w32tm /monitor at the command prompt.

I change the clock by 4 minutes, it didn't adjust

As far as I remember, clients will sync the time periodically - the gap between synchronizations gets greater as the time is in more sync. If the service detects that the time is out of sync alot - it will synchronize it and then check again x minutes later, if it finds that the difference the second time is less than the previous, it will gradually increase the gap between synchronizations. I can't remember the exact numbers though. Sorry, hope I explained all that ok?

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[mlocurci]

I am really interested in the details, where do you think we can find them?

 

[gmail2]

http://www.microsoft.com/technet/pr.../technologies/security/ws03mngd/26_s3wts.mspx

This should provice some light reading !!! There is a white paper from M$ on this too but I can't find it right now ... feeling a bit sleepy !!

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau