Monday, November 7, 2011

In a Windows network, the domain controller that holds the PDC FSMO role (responsible for time) can easily be off and/or not syncing with external resource correctly.  All of your domain's computers are set to sync with the domain by default.  Thus, devices, computers, and pretty much everything feels like it's out of sync with time...

How do I fix this issue?  Well with a few easy registry tweaks and command line entries, this can be solved quickly.

Oh yea, and whoever set up your domain should have done this for you... just saying.

You must be a domain administrator to make the following changes.

  • Verify that the event log shows that the server was syncing correctly
    • If there are no w32time event log entries, enable logging for windows time service:
  • Verify registry keys are set to pull time using NTP protocol (they probably aren't):
    • In the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer registry key, set value 'enabled' to 1:
      In the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient registry key, set value 'enabled' to 1:
      In the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Typeregistry key, set value 'Type' to NTP
  • Open an elevated command prompt and run command to set up pdc to sync with w32tm /config / /Reliable:yes /update
  • Restart the windows time service (using services.msc console or command line via w32time service)
  • In an elevated command prompt, you can force the immediate time sync of the local server (instead of waiting for the interval) by running this command: w32tm /resync
  • Verify event log messages indicate successful update and the time is correctly set.
See wasn't that easy?

Want to get more complicated?  You can actually purchase a time telling hardware device and configure your domain to sync with this.  It isn't free so I didn't get into it here.

Review the following Microsfot KB Articles for details: ,

No comments: