AwinishNaitik's Technical Blog

Lets continue the journey of learn & Share..

Windows Time Server Role In AD Forest/Domain

Posted by Awinish on October 7, 2011

I have seen various query related with the windows time service configuration in forest and domain, so I decided to pen down a article which might be helpful to answer the queries. Foremost, let’s try to understand what is the time server role, how and why it is important to set it right in forest/domain and implications involved if it is not configured or assigned to the right PDC((Primary Domain Controller)) Emulator DC(Domain COntroller) in the forest/domain.

Time server role is assigned to the DC holding PDC role in the domain, but if there are multiple domains in the same forest then how to assign the time server role and which domain PDC should be the time server for other domains?

By default, there is one PDC Emulator in each and every domain and the reason to assign time server role to only DC holding PDC role is DC with PDC role is a king of the kingdom with ability to authorize the changes to resolve or avoid conflicts. When new objects are created or existing object are modified in AD (Active Directory), it is first validated by the PDC and post authorization allowed to replicate the changes to all other DC’s in the forest/domain to check/avoid collusion.

User login to domain, Kerberos ticket assigning,  AD/DNS replication, Creation/Change/modification in AD etc. are all dependent on time server ,so if there is time mismatch between DC’s in the domain authentication will fail, changes will not replicated to other DC’s, resource access will fail and so many other tons of issues.

By default domain allow time skew of 5min means systems in the domain including DC can have time difference of 5mins but not more or less then that else user will not be able to login to the system and get authenticated by the DC whose time system differs by more than 5mins.

If, there is single domain in the forest then it is easy in choosing PDC role to play as time server role, but if there are multiple domain Like Parent-Child or Tree-Root domains then make DC with PDC role in the Parent/Root domain to be the time server and let all other forest to sync time from the Parent/Root DC but it should be only DC holding PDC role.

By default, DC holding the PDC role syncs the time from the reliable/external source and all other the domain clients follow the PDC as their time source to sync their time. The protocol used by the time server is NTP/SNTP.

In some cases you need to reset the time service configuration on the DC or member machine, the simple fix is unregister the time service on the problem member machine and re-register it using below cmds. It worked for me most of the time and should work for you too.

– Type CMD in the run windows

–  Type Net stop w32time to stop the time service

–  Type W32tm /unregister to unregister the time service registry

–  Type W32tm /register to register the time service registry back

–  Type Net start w32time

 Port Assignments for the Windows Time Service

Service name

UDP

TCP

NTP 123 NA
SNTP 123 NA

August 2011 cumulative time zone update for Windows operating systems

http://support.microsoft.com/kb/2570791

References

How to configure authoritative time server

http://support.microsoft.com/kb/816042

Configure a client computer for automatic domain time synchronization

http://technet.microsoft.com/en-us/library/cc758905%28WS.10%29.aspx

Configure the Windows Time service on the PDC emulator in the Forest Root Domain

http://technet.microsoft.com/en-us/library/cc786897%28WS.10%29.aspx

Configuring a time source for the forest

http://technet.microsoft.com/en-us/library/cc784800%28WS.10%29.aspx

Keeping the Domain On Time

http://blogs.msdn.com/b/w32time/archive/2007/09/04/keeping-the-domain-on-time.aspx

Windows Time Service Tools and Settings

http://technet.microsoft.com/en-us/library/cc773263%28WS.10%29.aspx

How to turn on debug logging in the Windows Time Service

http://support.microsoft.com/kb/816043

A list of the Simple Network Time Protocol (SNTP) time servers that are available on the Internet

http://support.microsoft.com/kb/262680

Windows Time Service Technical Reference

http://technet.microsoft.com/en-us/library/cc773061%28WS.10%29.aspx

Windows Time and the W32TM service

http://blogs.technet.com/b/industry_insiders/archive/2006/08/29/w32-tm-service.aspx

High Accuracy W32time Requirements

http://blogs.technet.com/b/askds/archive/2007/10/23/high-accuracy-w32time-requirements.aspx

NET TIME and w32time

http://blogs.msdn.com/b/w32time/archive/2009/08/07/net-time-and-w32time.aspx

Windows Time Service

http://blogs.msdn.com/b/w32time/

 

Advertisements

8 Responses to “Windows Time Server Role In AD Forest/Domain”

  1. prashant said

    Excellent Post…!!!!!! Gives Good information on PDC and Time Server Role.

    Enjoyed Reading this.. Thanks Awinish…………

  2. Awinish said

    Thanks Prashant.for your comment.

  3. Prashant said

    Hello Awinish,

    I know DC’s Use UTC Time zones for time sync between them. But I am not getting what is this UTC????? Whether all DC’s will be having same UTC Time,date etc….How to check this UTC Time in Domain controller??? Are we having any commandlet or tool to check the UTC Time of Domain Controller?
    ????

  4. Awinish said

    Prashant, Refer this link http://www.nhc.noaa.gov/aboututc.shtml

  5. Prashant said

    Thanks for the link Awinish. But still I have some difficulty in understanding this.
    For Eg – I have Two DC ( one in USA and One in India). How the Time will be synced between these two ?????

    I know , I dont have much knowledge about Time Zone convention with respect DC. I have read some where that all the DC’S use UTC Timing’s and Replication Happens with the help of it.

    Just want to know what is this UTC with respect to DC?????????? 😦

  6. Awinish said

    The domain controller placed into different time zones sync time using UTC(Coordinated universal time) and the time displayed locally is for human not for the systems. It internally follows the same duration and schedule but the time display when you see local to your zone is visible what is based on calculation of +-.

    http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/b83246a8-e041-4a67-be16-58da8786e85c/

  7. Prashant said

    Excellent!!!!!!!

    90% Understood. Still 10% remaining 🙂

    Does this mean If I set a site link between INDIA-USA site and schedule the replication from 12:00AM to 12:30 AM on DC which is in INDIA , then the DC which is in USA Will replicate the changes at its 12:00AM to 12:30 AM on its actual time ????or it will replicate depending on INDIAN time set (i.e 12:00PM US Time)

  8. Prashant said

    Got the Fundaaaaaa!!!!!

    Apologies!!!!!! I did not understand the link properly.

    Thanks for answering my qurey.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s