Active Directory Administrators
Time synchronization between Windows based systems is important because time stamps are used in many forms of authentication, encryption and security methods. If the clocks of two computers are too far apart, they simple may not be able to communicate with each other and may experience several kinds of esoteric failures.
By default, in a Windows environment, domain-joined machines will synchronize their time with their domain controller. All domain controllers will get their time from the domain controller (DC) that is the PDC emulator. All time in your environment flows out from this one server. It is important to have this service synchronized with an accurate time source.
- Windows Time Service
- NTP org service
Because of the flow of time synchronization in the domain, it is important to note that modifications to the time source should ONLY be done on the PDC emulator. This PowerShell command will help determine it:
Get-ADForest | Select-Object -ExpandProperty RootDomain | Get-ADDomain | Select-Object -Property PDCEmulator
You can determine the current synchronization target of the computer by running (on the PDC Emulator):
w32tm /query /source
This is sometimes “Free Running Clock” or “CMOS Clock”, which indicates it is not synchronized to anything.
You can determine the polling interval of a computer with:
w32tm /query /status
Domain controllers and member servers do not typically have the same interval – member servers are longer, and frequently at least an hour. So, you may wish to incrementally change the time of the “Free Running” PDC, over the course of a few days, prior to synchronizing it to an official time source.
Plan Your Synchronization to Public NTP
You can determine how far off the clock currently is from the preferred target with:
w32tm /stripchart /computer:time.windows.com /samples:5 /dataonly
If the difference is large, immediately changing the time to synchronize may not work correctly, or may induce failures within the domain as computers fail to talk to one another.
Synchronize with Public NTP
To synchronize it, use:
w32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:yes /update
Or you can use:
w32tm /config /manualpeerlist:0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,0x1 /syncfromflags:manual /reliable:yes /update
Depending on your preferred source.