Windows Server Time Synch Issue(s)

[mlc9]

I came aboard my job with our domain time being off by 5 minutes, and have pulled my hair out trying to fix the issue. I'll worry about my client computers as soon as I can fix the server, but just need to get to PDC server synch'ing first.

No matter what changes I make to the time settings in the registry, it continues to stay about 5 minutes behind. I've tried pointing to both internal time servers and external sources.

From a command prompt, when doing a "net time /querysntp" command, it will correctly state the NTPserver in the registry. When just doing a "net time" command, it tells me the current time at the secondary domain controller. Below are the current registry settings. Please let me know if any more info is needed to provide the much appreaciated help.
____________________________________________________________

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time]
"Description"="Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

"
"DisplayName"="Windows Time"
"ErrorControl"=dword:00000001
"FailureActions"=hex:05,00,00,00,00,00,00,00,00,00,00,00,02,00,00,00,64,00,20,\
00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00
"Group"=""
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
00,65,00,00,00
"Objectname"="NT AUTHORITY\\LocalService"
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config]
"LastClockRate"=dword:0002625a
"MinClockRate"=dword:000260d4
"MaxClockRate"=dword:000263e0
"FrequencyCorrectRate"=dword:00000004
"PollAdjustFactor"=dword:00000005
"LargePhaseOffset"=dword:02faf080
"SpikeWatchPeriod"=dword:00000384
"HoldPeriod"=dword:00000005
"LocalClockDispersion"=dword:0000000a
"EventLogFlags"=dword:00000002
"PhaseCorrectRate"=dword:00000007
"MinPollInterval"=dword:00000006
"MaxPollInterval"=dword:0000000a
"UpdateInterval"=dword:00000064
"MaxNegPhaseCorrection"=dword:00000e10
"MaxPosPhaseCorrection"=dword:00000e10
"AnnounceFlags"=dword:00000005
"MaxAllowedPhaseOffset"=dword:0000012c

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters]
"ServiceMain"="SvchostEntry_W32Time"
"ServiceDll"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,33,00,\
32,00,74,00,69,00,6d,00,65,00,2e,00,64,00,6c,00,6c,00,00,00
"Type"="NTP"
"NtpServer"="time.nist.gov,0x1"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,9d,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,18,00,9d,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient]
"Enabled"=dword:00000001
"InputProvider"=dword:00000001
"AllowNonstandardModeCombinations"=dword:00000001
"CrossSiteSyncFlags"=dword:00000002
"ResolvePeerBackoffMinutes"=dword:0000000f
"ResolvePeerBackoffMaxTimes"=dword:00000007
"CompatibilityFlags"=dword:80000000
"EventLogFlags"=dword:00000001
"LargeSampleSkew"=dword:00000003
"DllName"="C:\\WINDOWS\\system32\\w32time.dll"
"SpecialPollTimeRemaining"=hex(7):00,00
"SpecialPollInterval"=dword:00000384

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer]
"InputProvider"=dword:00000000
"AllowNonstandardModeCombinations"=dword:00000001
"DllName"="C:\\WINDOWS\\system32\\w32time.dll"
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Enum]
"0"="Root\\LEGACY_W32TIME\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

 

[unclerico]

On DC2 did you rerun the w32tm /config /update /syncfromflags:domhier /reliable:yes?

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[mlc9]

Yes, more than once. I even rebooted the entire server after doing so.

 

[unclerico]

Try these:

w32tm /resync /rediscover
w32tm /monitor

Let me know what the output of the commands is

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[mlc9]

resync/rediscover produced:
"The computer did not resync b/c no time data was available"

w32tm /monitor produced:

[primary DC computer name] ***PDC*** [IP address]:
ICMP: 0ms delay.
NTP: +0.0000000s offset from [primary DC computer name]
RefID: [internal time server name) [IP Address]
[secondary DC computer name] [secondary DC IP address]
ICMP: 0ms delay.
NTP: +272.7618052ss offset from [primary DC computer name]
RefID: 'LOCL' [76.79.67.76]

 

[unclerico]

stubborn fricken time service...gotta love it.

restart the time service and look in the event viewer for the w32time events. If it doesn't show that it is syncing correctly then run throught the following one more time:
1) Stop the time service
2) w32tm /unregister
3) w32tm /register
4) w32tm /config /update /syncfromflags:domhier /reliable:yes
5) Start the time service

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[mlc9]

Dang. I feel that we're oh so close. I tried all of the above again, it it did not appear to help. As soon as I did it, I did a resync command, and it couldn't find an available time source again.

When doing those commands, the one difference is that you must start the time service (step 5), before running the config /update command (step 4). Otherwise, it errors out. This really makes no difference, as it all appears to work just fine as far as executing the commands.

I can't thank you enough for hanging in there with me. Again, it feels so very close.

 

[mlc9]

After many attempts in the event viewer last evening by the secondary DC to find a valid time source, I get the following system event:

Description:
The time provider NtpClient is currently receiving valid time data from [PDC computer name]

Then, less than 60 seconds after that, I get these next two entries simultaneously:

Description:
The time provider NtpClient was unable to find a domain controller to use as a time source. NtpClient will try again in 15 minutes

Description:
The time provider NtpClient is configured to acquire time from one or more time sources, however none of these sources are currently accessible. No attempt to contact a source will be made for 15 minutes. NtpClient has no source of accurate time.

It seems as though the secondary DC was able to source time from the PDC for just a few seconds, then couldn't find it again. I am just wondering if there is a trust issue somewhere?

 

[unclerico]

restart the time service on DC2 and see what happens.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[mlc9]

I had actually already done that, and it produced no results.

I realize this is absolutely wrong, but this is what I've done. I went in to secondary DC registry and added NtpServer of [internal time source], and changed the type from Nt5DS to NTP. Basically, it is now mirroring the PDC.

I then rebooted the secondary DC, and it came back up sourcing the internal time server perfectly, and the time on this secondary DC was right on. I then rebooted my own client computer, and it also now has the correct time (it appears to be looking to secondary DC for such).

What problems do you see with this, if any? I was just starting to get nervous, b/c my Exchange server time is still off, and I now see sporadic people loosing their connection to the email server. I imagine this is b/c of this time situation.

 

[unclerico]

yes, I would go to the Exchange server and do the usual:
1) look in event viewer for the W32Time events
2) w32tm /resync /rediscover

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[mlc9]

Well, I guess then I will just keep both domain controllers acting as time sources, in theory.

I did the same with Exchange, as with all other servers. I unregisterd and re-registered time service, then did a resync. All servers and clients appear to now have the correct time under this somewhat unorthodox setup (two DC's acting as the primary time source). Most event logs show servers and clients syncing with the PDC, but it took me configuring the secondary DC in this manner for all of this to fall into place.

unclerico.......you have taught me much throughout all of this, and I am very greatful. There is a steak dinner waiting for you somewhere in the southeast.....mlc9

 

[unclerico]

im glad its working for you...NTP can be a PITA when it wants to be.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)