In a Domain it is generally a mistake to have workstations find a time source other than the authoratitive time source for the Domain itself.
Abstracts for several sources:
Fixing timesync is different according to the machine type...
. If it's a Member Server, standard Domain Controller (not a PDCEmulator) or standard workstation then behave as if its a member server (below)
. If it's a PDCEmulator then make sure you allow port 123 TCP/UDP outbound on your firewall and configure the external microsoft time service by entering this at the command line
NET TIME /SETSNTP:time.windows.com (or other external time server(s), as you can provide a list)
. If it's a workstation, member server or a standard Domain Controller:
Members of the Active Directory sync with their local DC (local as in local AD site). The DCs then sync with the PDCEmulator, so the PDCE is the authoratative time server unless manually specified otherwise.
Diagnosis of timesync errors is difficult, but do not be tempted to use NET TIME /SETSNTP: on all machines in the domain; as it specifically overrides the natural internal operation of the time service within Active Directory.
The commands used below are written for Windows 2003 and Windows XP. There are some equivalents for windows 2000: use W32tm /? or W32Time /? from the command line to look for alternatives on older OSs. In Win2k usually a hypen is used instead of "/" for parameters.
. Use NET TIME /SETSNTP:
to clear any entry and return to the default settings
. Use NET TIME /SET /YES
to synch NOW with your authenticating DC and begin the diagnosis:
. Start by verifying your domain is synching AD by using REPLMON.EXE in the support tools pack on the Windows installation CD.
. If this is OK then run this from the command line:
W32TM /monitor
to ensure that each member server/workstation is actually pointing to a DC.
If this is OK then run this from the command line:
W32TM /resync /rediscover
followed by:
W32TM /resync /nowait
and check the system eventlog for W32TIME errors. This process does a full reset and recheck of the time system as it relates to one member machine on your AD.
In a complicated Domain heirarchy, the time likely is not identical across the Domain. Timesync works in an interesting way on member servers and workstations:
. If the local clock time of the time client is behind the current time received from the time server, W32Time will change the local clock time immediately.
. If the local clock time of the time client is more than three minutes ahead of the time on the time server, W32Time will change the local clock time immediately.
. If the local clock time of the time client is less than three minutes ahead of the time on the server, W32Time will quarter or halve the clock frequency for long enough to bring the clocks into sync. If the client is less that 15 seconds ahead, it will halve the frequency; otherwise, it will quarter the frequency. The amount of time the clock spends running at an unusual frequency depends on the size of the offset that is being corrected.
. For the time authority in a Domain, W32Time will periodically check its local time with the current time by connecting to the time source. This process starts as soon as the service turns on during system start-up. W32Time attempts synchronization every 45 minutes until the clocks have successfully synchronized three times. When the clocks are correctly synchronized, W32Time then synchronizes at eight-hour intervals, unless there is a failure to obtain a timestamp, or a validation failure. If there is a failure, the process starts over from the beginning.
If the workstation or member server is really wrong on the time, use the DUMPFSMOS tool to find the PDCE:
Reset the time on the PDCE as discussed above, then force a time sync on the workstations (net time /set /yes).
When you run NET TIME without the /domain option, the workstation will iterate through the list of time sources on the network, and contact the first one encountered. By default on an NT or 2000 network, only the PDC is a time source. However, if Domain Time Server is installed on any machine, that machine also becomes a time source. Notice that the NET TIME client won't use the nearest time source -- it will use the first one found in the browser list.