Domain time is 5 minutes off, cannot figure out how to fix it

[3rik7]

First of all, I apologize if this is not the right forum to post this question. I didn't see one that seemed any more appropriate.

Some background...
I just started working for a new company a month ago. Though I did not get hired on to be a network admin, the day before I started the company fired the current network admin so I was immediately promoted into that postion on day 1. I would say I have some basic junior level network admin experience.

So from day 1, I noticed that the time on my PC was off by 5 minutes. I soon discovered that the clocks on all the PC's and servers on our domain run 5 minutes slow. I have no idea how it was all initially set up but in doing some research, this is what I've found...

DomainController1 holds all the FSMO roles.
DomainController2 does DHCP and DNS

When I do a net time /querysntp command from any PC on the domain, the response is time.windows.com. According to what I've read on the internet, time.windows.com is unreliable.

When I do a net time command from the PC's on the domain, I get a response of DomainController2.

When I do a net time /querysntp from DomainController2 I get a response of time.windows.com
When I do that some command on DomainController1, I get a response of "This server is not currently configured to use a specific SNTP server".

So from what I can gather, DomainController2 is providing the time for the network and it is getting the time from time.windows.com.

My question is how do I change that to pull the time from something more accurate? Are there any adverse effects I should be concerned about? I know there are security/Kerberos issues when network time is not in sync.
I'm concerned that DomainController1, which holds all the FSMO roles, is not configured to use a time server so therefore when I update the time source on DomainController2, DomainController1 will not get updated and start causing some serious problems.

Any help would be appreciated. And sorry for the long post.
Thanks.

 

[pagy]

The server holding the PDC Emulator FSMO role in the domain is the one all the other (domain joined) machines look to to get their time.
Having the wrong time is not a problem, from an authentication point of view, as long as all the machines have the wrong time and are within the kerberos time window which is 5 minutes by default.

Typically the server holding the PDC Emulator role is configured to sync to an external NTP time source and then all other machines get their time upon logon from that server.

http://www.windowsnetworking.com/articles_tutorials/Configuring-Windows-Time-Service.html

Paul
MCTS: Exchange 2007, Configuration
MCSA:2003
MCSE:2003
MCITP:Enterprise Administrator

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

Difficult takes a day, impossible takes a week

 

[3rik7]

Ok. I'm confused then.

When on my PC (which is joined to the domain) when I run the "net time" command, it says "current time at DomainController2 is xxxxx", which implies that it is getting the time from DomainController2.

When I use the NETDOM utility to check which server holds the 5 FSMO roles, it says they are all being held by DomainController1.

So is it a fair assumption to say that our domain was set up "not typically"?

Where would DomainController1 be getting it's time from if it is "not currently configured to use a specific SNTP server"??? By the way, it is also exactly 5 minutes off like everything else on the network.

I read the article you linked to and it seems to imply that your PDC Emulator should be synching to Stratum 1 time source. Then, according to the hierarchy, all other network devices should be synching their clocks with the PDC emulator (Stratum 2, in our case DomainController1). If that is not available, then it will try synching with another domain controller (Stratum 3, in our case DomainController2).

Am I assessing our situation correctly or am I missing something???

 

[58sniper]

You need to configure DC1 to get time from a trusted source. If you search this forum, you'll see examples. Once it's working, block NTP traffic at the firewall to only your DC1.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/