Change time on 2008 server

[people3]

HI,

Hopefully a simple question.

The time on our pc and servers is about 6 mins ahead. I would like to change this back by 6 min.

The Domain time is controlled by our 2008 r1 server which also holds all the AD roles. We have an exchange 2007 and SQL 2008 servers and about 100 pc's

Will setting the time back by 6min cause any issues, logging in ect. Especially with exchange or users PC's. what is the best way to do this 6 min in one go or a couple of min per day for the next 3 days

Many Thanks

 

[58sniper]

Configure the server that holds the PDC emulator role to query an external time source. It will adjust automatically, and domain joined machines will query it and do the same.

Stop by the new Tek-Tips group at LinkedIn. Come say hi, look for a job, have some fun.

http://www.linkedin.com/groups/Networking-TekTipscom-forums-members-3952395

Pat Richard MVP

http://www.exchangeblogs.com/

 

[people3]

thanks pat, will it matter that there is a 6 min jump, or will it gradualy change the time?

 

[kmcferrin]

I believe the cutoff used to be 5 minutes, if the drift was less than 5 minutes then it would gradually adjust, if it were more than 5 minutes then it would just make the change. I'm not sure that applies anymore, as every time I have configured NTP I have seen the time jump immediately. Of course that's probably because I'm restarting the Windows Time service and that forces a resync.

If you don't have a large network then you might want to just restart W32time on each host to be safe.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCSE:Security 2003
MCITP:Server Administrator
MCITP:Enterprise Administrator
MCITP:Virtualization Administrator 2008 R2
Certified Quest vWorkspace Administrator

 

[58sniper]

kmcferrin - that's actually backwards, I believe. If the drift was more than 5 minutes, it would correct slowly, in order to avoid kerberos issues. Like you, I've seen that different in recent times when initially configuring sync with an outside source.

Stop by the new Tek-Tips group at LinkedIn. Come say hi, look for a job, have some fun.

http://www.linkedin.com/groups/Networking-TekTipscom-forums-members-3952395

Pat Richard MVP

http://www.exchangeblogs.com/

 

[kmcferrin]

Now I have to look it up. My recollection was that it would correct it slowly if the drift was less than 5 minutes because it was still within the tolerances of Kerberos, but if it was greater than 5 minutes it exceeded the tolerance and just corrected it to avoid problems. I haven't read that KB article since the Windows 2000 days, so I may be wrong, but I remember the description being somewhat counter-intuitive.



________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCSE:Security 2003
MCITP:Server Administrator
MCITP:Enterprise Administrator
MCITP:Virtualization Administrator 2008 R2
Certified Quest vWorkspace Administrator

 

[58sniper]

If it was over 5 minutes, it would slowly adjust as to not break kerberos connections. The issue isn't whether the server and time source was off by > 5 minutes. It was whether the PDCe and its domain connected resources where more than 5 minutes apart. If the PDCe was > 5 minutes off from it's external source, it couldn't just quickly change, as that would affect kerberos connections from workstations and servers.

I could be wrong, but that's how I remember it.

Stop by the new Tek-Tips group at LinkedIn. Come say hi, look for a job, have some fun.

http://www.linkedin.com/groups/Networking-TekTipscom-forums-members-3952395

Pat Richard MVP

http://www.exchangeblogs.com/

 

[people3]

HI,

Thanks for the info.

If i change my server's time to sync from an external source, will this cause the change to be instant, as the time is 6 min out will this kill the connectios to all the PC and other servers?

If Kerberos connections are broke will it just be a simple matter or rebooting to restore.

We have a mix of XP and win 7 PC's (servers are all 2008 R1)


Cheers

 

[kmcferrin]

See, I told you the explanation was counter-intuitive.

Based on Pat's reply (which does make sense when you dig) I think you'll be fine. You just won't see the results for awhile.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCSE:Security 2003
MCITP:Server Administrator
MCITP:Enterprise Administrator
MCITP:Virtualization Administrator 2008 R2
Certified Quest vWorkspace Administrator