Registry entry for NTP server ???

[lanamater]

I have a problem I have been fighting for some time now. I took over a network that had an NTP server running internally. I installed a new NTP server and assigned a new IP address. I went through all of the W32TM functions to make the clients receive the new NTP server info. All clients appear to be receiving NTP responses properly from the new NTP server. Unfortunately there is an entry in every Windows box registry that refers to the IP of the old NTP server. It is located at: HKLM-Software-Policies-Microsoft-W32time-Parameters-NTPServer. I cannot find any GPO that is referring to NTP (domain is 2000 and I had to import the ADM template for NTP server support from an XP client.) This made no change at all to the referenced reg entry.

The issue is not that NTP clients look to the old IP for NTP syncs, but that if I shutdown the old NTP server all the clients start ARPing for the IP of the old NTP server. I capture network data and no NTP traffic is passing to the old server, but ARP requests are flooding the network if the old NTP server is powered off.

So I don't think this is an NTP problem, but a domain problem for how the clients receive the registry entry. If I manually change the IP in the registry the ARPing stops. If I reboot the client that I changed the registry setting on, it returns to the old IP. Also it looks like the registry refreshes every night and causes the IPsetting in the registry to revert to the old IP.

My question is: Does anyone know exactly how the registry entry at: HKLM-Software-Policies-Microsoft-W32time-Parameters-NTPServer gets populated? If so, is there any procedure to change it at the domain level?

Thanks!

 

[wdoellefeld]

Is your DHCP server handing out the old IP by chance? Look at the scope and server options.


FRCP

http://www.frcp.net

 

[lanamater]

DHCP is handing out the new address. I forgot to mention that. The odd thing is that NTP functions correctly. All the clients sync with the new address. It is just that everyone is arping for the old address because of the registry entry. It is bizarre.

 

[wdoellefeld]

Not sure how to revert the reg key back to nothing.

Sounds like the old admin hard set each workstation using net time /setsntp [old ip]. This writes that reg entry.

Instead of trying to take it out, I suppose you can update it with the new IP. Maybe use with a logon script.

FRCP

http://www.frcp.net

 

[lanamater]

Well, even new computers that get added to the domain get this setting.

Actually net time /setsntp [IP] sets this reg entry: HKLM-System-CurrentControlSet-Services-w32time-Parameters-NTPServer

It doesn't hard code this entry: HKLM-Software-Policies-Microsoft-W32time-Parameters-NTPServer

I am assuming that since it is under Policies, that a policy is pushing this IP out.

I have considered updating with a script. This issue with this workaround is that not all users log off everyday. When the policy refreshes overnight, the IP reverts to the original.

 

[wdoellefeld]

Your right, I wasn't paying close enough attention the key. Sorry for the confusion

Wow, this is an interesting problem. As I understand it the option is only on the XP pro and server 2003 templates. Your saying the current applied GPOs are showing unconfigured. One thought is some local policy but that doesn't help explain the new machines getting it. Are these machines getting an old image at all (made by the previous admin)? How about importing the ADM template for server 2003? Maybe putting the new IP in the a another GPO.

These types of problems suck. Luckily for me previous admins at all the places I've worked cared about really making sure things were well documented.



FRCP

http://www.frcp.net