event id29 w32time time server

[4johnny]

I am getting this system event error on our DC. This DC cannot acquire time from one or more sources.....
The source (HKLM/system/currentcontrolset/services/w32time/timeporvider/ntpserver) is set to: time.windows.com

There are other DCs in our network (we have 2 site locations and 5 DCs). From what I understand, there is one authoratative time server in a network thatgets its time from an external controlled website (like time.windows.com). And then all other computers in the network would get its time set from this authoratative server.
1)how do I check to see which DC is the authoratative time server
2)what is the best website that the authoratative server should be getting its time from?
3)how do I set my DC or any client for that matter to get its time from the authoratative server..a reg setting?

Thanks

 

[WhoKilledKenny]

1)how do I check to see which DC is the authoritative time server

From my understanding, All workstation and Servers look to the PDC emulator for time. So the DC that is running PDC FSMO role should be the one that is set.

2)what is the best website that the authoritative server should be getting its time from?

Personally I have found that Military and University sites work well for me.

3)how do I set my DC or any client for that matter to get its time from the authoritative server..a reg setting?

external time server you use "Net Time" command. Internal - domain members will use the PDC emulator without any configuration on your part.


Jesse Hamrick

http://www.powershellpro.com

 

[Cstorms]

to set your pdc to the ntp source of your choice you would use the w32tm /config /manualpeerlist:<target ip or web address>

Below is a list of some of the flags and what they do.

http://technet2.microsoft.com/windo...cce2-4c82-b3ea-3b95d482db3a1033.mspx?mfr=true

You could edit the registry but I always wonder why not just do it this way, you wont have to work about if you messed with the 0x# thing thats in the reg.

 

[4johnny]

kind of dropped this for a while and now I am back to it.

When I issue the net time command on client PCs, I found out that most of our office client computers are looking to DC02 for its time. So, I assume that must be the authoratative time server in our domain.

the problem is DC01 is getting errors like:

1)The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 960 minutes. NtpClient has no source of accurate time.

2)Time Provider NtpClient: No valid response has been received from manually configured peer time.windows.com after 8 attempts to contact it. This peer will be discarded as a time source and NtpClient will attempt to discover a new peer with this DNS name.

So... do I just need to use the w32tm /config /manaulpeerlist: command and re-direct it to DC02 instead of time.windows.com???

thanks

 

[Cstorms]

So your DC02 is the PDC emulator role holder? If DC01 is actually a DC in the domain it should be pointing to the PDC role holder DC as that is what holds the time for the domain, then DC02 should be syncing from an external source (something like pool.ntp.org)

Cory

 

[4johnny]

That is what is confusing me....I ran the 'netdom query /domain:<domain> fsmo' command on DC01 and the PDC role is DC01 for our domain. However, when I run the 'net time' command on client PCs it returns with the current time on DC02. Correct me if I'm wrong, but it appears to me that all our client PCs look to DC02 for their time sync.

when I ran the w32tm /monitor command this is what is returned:

C:\>w32tm /monitor
dc01.mycompany.com *** PDC *** [192.168.2.1]:
ICMP: 0ms delay.
NTP: +0.0000000s offset from dc01.mycompany.com
RefID: unspecified / unsynchronized [0.0.0.0]
dc02.mycompany.com [192.168.1.1]:
ICMP: 61ms delay.
NTP: -3.9406884s offset from dc01.mycompany.com
RefID: dc04.mycompany.com [192.168.1.2]


If the PDC is the authoratative time server then I think all i need to do is run this command on DC01:

w32tm /config /manaulpeerlistool.ntp.org

Thanks for your help

 

[ILW]

Take a peek at

http://support.microsoft.com/kb/223184

This documents how time is supposed to work. If you have a domain, you shouldn't be using NTP and specifying a particular source for the PCs & non-DC servers. One DC should point to one or more external sources (e.g. US military if you're that side of the pond - google it) You need to set Type to NT5DS, which means that the devices look to the domain itself rather than one or more specific sources.

The doc also shows how you mark a specific server as a "reliable" time source.

These settings should be defaults for domain members, but from bitter experience it doesn't always work that way.

Enjoy

Ian

 

[4johnny]

OK thanks, that info was helpful. I was able to change DC01 to look at ntp2.usno.navy.mil for its time instead of time.windows.com which it was not able to reach. Once DC01 was able to connect to an external working time server then all of the clients now look to DC01 for its time instead of DC02.

So I am assuming that if the DC that holds the PDC FSMO role is not configured properly to go and get the correct time then all of the clients in the domain will default to another DC as its authoratative time server. Once I corrected this problem then all of the clients reverted back to the PDC FSMO role holder, DC01.

 

[Cstorms]

They will always point to the PDC emulator, if the time data is inconsistent with the outside world client machines will still reflect whatever the DC is telling them. Something to maybe remember, by default policy if client time data is out of sync by more then 5 minutes then clients will not be able to log in to the domain.

If your PDC role holder goes offline you would simply (or at least hope its simply transfer the role to the other domain controller.

Cory