Windows Server 2003 w32tm problem.. Time ahead a consistent 6 minutes.

[markm75]

I'm having some weird issues on my pdc emulator 2003 machine.

I have configured it to use an external time provider, I have verified
I can ping the provider.


basically I ran this on the emulator:
w32tm /config /syncfromflags:manual /manualpeerlist:"time.windows.com
tock.usno.navy.mil time.nist.gov"
net time /setsntp:"time.windows.com tock.usno.navy.mil time.nist.gov"


w32tm /config /update
net stop w32time
net start w32time


My goal is to then make sure that all workstations and servers in the
domain know to get the current time from this pdc emulator.. so to
achieve that i added net time /setsntpstdc2 to the login script for
the workstations. It was my understanding I shouldnt need to do this
though.


After all this..


At the PDC.. if i enter net time.. instead of showing the external
source.. it says.. current time at \\pstdc is etc.


Note the pstdc (another server, not the emulator).. At one point I did
have the other server as the time emulator.. but realized it should
have been pstdc2, as it is the pdc emulator. I've of course ran the
lines above so it should all be set.


The other issue i have is running


w32time /stripchart /computer:IPADDRESS


Where for ip address i've tried various external sources. If I
manually change the clock, say move it ahead 4 minutes, when I run
that.. it actually says.. the current time is 12:36 (the moved ahead
time).. then the lines that follow are 12:36:27 , 12:36:29 etc.. so its
like its getting the time from itself and not really the outside
source..


here is the snipet:
C:\Documents and Settings\markm\Desktop>w32tm /stripchart
/computer:tock.usno.na
vy.mil
Tracking tock.usno.navy.mil [192.5.41.41].
The current time is 3/31/2006 12:36:27 PM (local time).
12:36:27 d:+00.0466380s o:-175.2398671s [@ |
]
12:36:29 d:+00.0156020s o:-175.2441210s [@ |


Does anyone know why I cant seem to get the pdc emulator to sync. up
with an external time server via these commands?


BTW.. I can run a seperate utiltiy on the server to sync the time, but
obviously this isnt desired as it is a domain server.

 

[SDPT]

this guy is really good:

http://www.windowsnetworking.com/articles_tutorials/Configuring-Windows-Time-Service.html

_________________________________
IBM CP, MCP 2000, E60 driver ;-)

 

[markm75]

I have followed the tips located here that you gave me (thanks for the help):

http://www.windowsnetworking.com/articles_tutorials/Configuring-Windo...

I did the ones pertaining to setting up the PDC emulator with an
outside source (time.windows.com, 0x1), set all the registry keys,
restarted the services, still the same lowsy 6 minutes ahead of the
atomic time deal.


I also had the setting from computer config, admin templates for
setting the time server to this PDC, but I feel maybe I didnt need
that, so I just tried removing that setting...


At any rate.. all of my workstations are in synch with the PDC, but
the PDC is always 6 minutes ahead of the atomic time, I cant figure
out how to fix this..


UDP 123 is open so this shouldnt be the issue either (and I can use
3rd party software to do the synch), but it gets reset to that 6 mins
ahead thing, after so many minutes.


Any help would be great.

 

[kmcferrin]

Note the pstdc (another server, not the emulator).. At one point I did
have the other server as the time emulator.. but realized it should
have been pstdc2, as it is the pdc emulator. I've of course ran the
lines above so it should all be set.

This part concerns me. In AD, the server that holds the PDC Emulator role is always responsible for time synchronization. It would not have been possible for "pstdc" to be the authoritative time server for the domain unless it were also the PDC emulator. If "pstdc2" had held the PDC Emulator role all along, then it would have also been the authoritative time server, and never "pstdc".

The order of precedence for time servers in AD is as follows:

• All client desktop computers nominate the authenticating domain controller as their in-bound time partner.
• All member servers follow the same process that client desktop computers follow.
• All domain controllers in a domain nominate the primary domain controller (PDC) operations master as their in-bound time partner.
• All PDC operations masters follow the hierarchy of domains in the selection of their in-bound time partner.

I see two possibilities here:

1. You are in a multi-domain forest and the PDC Emulator for your domain is getting it's time from a DC higher in the hierarchy. In this case you'll have to get your upstream DCs to sync with the atomic clock.

2. Assuming that yours is a single domain forest, I would guess that your FSMO roles are not what you think they are. You can test this by opening Active Directory Users and Computers, right clicking on your domain name, selecting "Operations Masters", then clicking the PDC tab. The server listed there will be your PDC Emulator and the authoritative time server for your domain. If you want to make a different server the PDC Emulator you can change it there.

3. You have had DCs fail or be replaced in your domain without them being removed properly, and you have corrupt settings that for some reason make "pstdc2" think that it doesn't have the correct roles. You would have to clean this up using NTDSUTIL.

 

[markm75]

Thanks for the input.. I am in a single domain environment.

Yeah, at one point PSTDC2 had all the roles that PSTDC had, but I switched them back. I also verified that PSTDC has the correct roles and is the PDC emulator, as well as the machine set to be the parent time role (I also verified this using Spotlight on AD)...

I guess that setting in GPO wasnt needed from a workstations standpoint? Either way, the main server managed to switch its time back to the 6 minute ahead setting, after I ran 3rd party software to synch it correctly (minutes later). I just cant figure out where it is synching to.. I suppose I could try changing the time on PSTDC2, and see if for some weird reason it is pulling the time from there, despite having registry settings for time.windows.com etc (and being the primary time role).

 

[blakey2]

Hi,

I set up (fixed) my time server settings some time long ago so can't help with any in depth configuration.

However, i'd reccomend that you check with the time provider that you are alowed to connect to them and get time updates.

I use one of the universities' time server/service and I had to send them a polite email requesting that they grant access to our IP.

Cheers.

 

[LWComputingMVP]

Shot in the dark... is the server a virtual server or is it on a physical box? I had a problem where the host server for a virtual server (which was my FSMO Master DC) was constantly slowing down... I had to disable time sync on the virtual server software so that the PDC Emulator would properly sync and stay synced to an external time source.

 

[kmcferrin]

So if I'm reading correctly, at one point PSTDC had the PDC Emulator role and was synching with an external time server. Since then, the PDC Emulator role has been transferred to PSTDC2 which should have made it the time server for the domain. When running "net time" from PSTDC2 though, it shows that it still gets time from PSTDC even though you have configured an external time server AND transferred the PDC Emulator role, and double-checked that the PSTDC2 is now shown in ADU&C as the PDC emulator.

So here are two things to try:

1. Go back into ADU&C, and at the top of the tree in the left pane you will see "Actice Direcotry Users and Computers (fqdn of the DC that you are connected to)". Right click on that and select "Connect to domain controller". Connect to PSTDC2. The right-click on it again and select "Operations Masters." Go to the PDC tab and make sure the correct DC is listed. After you have done that, connect to PSTDC the same way and verify that it has the same, correct info.

2. This should be unnecessary if the first method shows the correct info, but it's worth a try. You can use NTDSUTIL to try to transfer the PDC role to PSTDC2. If it gives you any issues you can also use NTDSUTIL to seize the PDC role.

 

[markm75]

Nope.. this is a physical server.. I also know the time provider is ok, as I can connect and change the time with the 3rd party software.

Sequence of events.. originally, PSTDC was the PDC emulator (held all roles), wasnt set for time synch... then I had to switch roles to rebuild that server, switched em over to PSTDC2.. also tried setting up the time server stuff then, never really worked.

PSTDC came back online, I moved the roles back over to it.. so now, at this point, PSTDC has ALL roles, I verified this. It is set to NTS and to synch with external time source. If I do a w32tm /stripchart... it does show the time being off by 6 minutes or so.. but it never synchs up.. if I manually change the time.. it somehow gets set back to this 6 minutes ahead setting.

I'm thinking I may put in a call to MS today to hash this one out.. Seems to be pretty mysterious.

 

[markm75]

I had things working today.. still do.. at least on the server..

I think I know what is/was going on.. not sure how to fix it though (workstation side):


I have/had the Admin templates (GPO) set for the default domain policy initially (I then turned these off, put them in their own policy, linking them to the domain, probably the mistake):

System/Windows Time Service/Time Providers:

I set it to:

NTPserver PSTDC,0x1
Type: NTP
CrossSiteSYncFlags 2
ResolvePeerBackoffMinutes 15
ResolvePeerBackoffMaxTimes 7
SpecialPollInterval 3600
EventLogFlags 0

and also

Enable Windows NTP Client.

Once I set these and did a gpudate /force.. my computers clock went to the whole 6 minutes ahead setting (whereas after I got pstdc working and synched with the external atomic time, i ran the w32tm /resync command and the time was set correctly on my local machine)..

I assumed I also needed these registry settings set in GPO for workstations to synch properly?

Either way, they appear to hose the whole system..