none
Issue with Time Services RRS feed

  • Question

  • I am currently having an issue with my time services on my domain controllers.  For some reason they are about 7 minutes fast.  When I manually set the time to what the correct time should be, it is fine for the first little while, but after about 20 minutes, it jumps ahead about 7 minutes again.  I have also unregistered and reregistered the time service.  It looks like my DC is pointing to time.windows.com but I'm not 100% sure.

    My servers are Windows 2008 Server, SP2 with all roles on one server. Due to a cooling issue I was forced to shutdown all of my servers over the weekend.  When I brought them up this morning, I started having this issue.  One of my DCs was not advertising the time service, and after some troubleshooting I was able to resolve it.  My Windows clients can authenticate fine as they point my DC for time.  However I also run several mac clients connected to AD and these are no longer able to connect because of a time difference.  My Macs currently point to time.apple.com.  As a workaround, I am going to point them to my DC, but the time is still 7 minutes fast.

    Please help, thanks!

    Monday, May 3, 2010 6:33 PM

Answers

  • Does your PDC Emulator has accurate time? If not, is there any reason you can not set the time manually (look into configuring it to sync up with an external time source - although this will likely require firewall changes)? If you are running DC as a VM, make sure that you disable automatic synchronization with the host (unless the host is synchronized with a reliable time source)

    hth
    Marcin

    • Marked as answer by cshiershc Friday, May 7, 2010 9:01 PM
    Monday, May 3, 2010 10:57 PM
  • Chris,

    configure your PDC Emulator to synch up with a reliable time source. For all other domain computers, use default time synchronization mechanism based on domain hierarchy...

    hth
    Marcin

    • Marked as answer by Bruce-Liu Thursday, May 6, 2010 7:08 AM
    Tuesday, May 4, 2010 3:01 PM

All replies

  • Check the time on the DC functioning on the PDC Emulator.

    hth
    Marcin

    Monday, May 3, 2010 6:59 PM
  • Below is some information from the system logs that might help...


    Log Name: System
    Source: Microsoft-Windows-Time-Service
    Date: 04/05/2010 12:21:48 PM
    Event ID: 36
    Task Category: None
    Level: Warning
    Keywords: Classic
    User: N/A
    Computer: ad02.domain.com
    Description:
    The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients. The time service will continue to retry and sync time with its time sources. Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-Time-Service" Guid="{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}" EventSourceName="W32Time" />
    <EventID Qualifiers="33370">36</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-05-04T16:21:48.000Z" />
    <EventRecordID>54946</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>ad02.domain.com</Computer>
    <Security />
    </System>
    <EventData Name="MSG_TIME_SOURCE_NONE">
    <Data Name="UnsynchronizedTimeSeconds">86400</Data>
    </EventData>
    </Event>

    ---

    Log Name: System
    Source: W32Time
    Date: 03/05/2010 2:05:03 PM
    Event ID: 143
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: ad02.domain.com
    Description:
    The time service has started advertising as a good time source.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="W32Time" />
    <EventID Qualifiers="16986">143</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-05-03T18:05:03.000Z" />
    <EventRecordID>55029</EventRecordID>
    <Channel>System</Channel>
    <Computer>ad02.domain.com</Computer>
    <Security />
    </System>
    <EventData>
    </EventData>
    </Event>

    ---

    Log Name: System
    Source: W32Time
    Date: 03/05/2010 2:05:03 PM
    Event ID: 139
    Task Category: None
    Level: Information
    Keywords: Classic
    User: N/A
    Computer: ad02.domain.com
    Description:
    The time service has started advertising as a time source.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="W32Time" />
    <EventID Qualifiers="16986">139</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-05-03T18:05:03.000Z" />
    <EventRecordID>55028</EventRecordID>
    <Channel>System</Channel>
    <Computer>ad02.domain.com</Computer>
    <Security />
    </System>
    <EventData>
    </EventData>
    </Event>

    ---

    Log Name: System
    Source: W32Time
    Date: 03/05/2010 2:05:15 PM
    Event ID: 12
    Task Category: None
    Level: Warning
    Keywords: Classic
    User: N/A
    Computer: ad02.domain.com
    Description:
    Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="W32Time" />
    <EventID Qualifiers="33370">12</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-05-03T18:05:15.000Z" />
    <EventRecordID>55033</EventRecordID>
    <Channel>System</Channel>
    <Computer>ad02.domain.com</Computer>
    <Security />
    </System>
    <EventData>
    </EventData>
    </Event>

    Monday, May 3, 2010 7:04 PM
  • Have you configured the PDCe to use an external time source?  Check the link below to assist you in this.  All the other DC's should be getting their time from the PDCe and the clients from a DC within their site, although usually the authenticating DC.

    http://support.microsoft.com/default.aspx?scid=kb;en-us;816042

     

    --
    Paul Bergson
    MVP - Directory Services
    MCITP: Enterprise Administrator
    MCTS, MCT, MCSE, MCSA, Security+, BS CSci
    2008, Vista, 2003, 2000 (Early Achiever), NT4
    Microsoft's Thrive IT Pro of the Month - June 2009
    http://www.pbbergs.com

    Please no e-mails, any questions should be posted in the NewsGroup This
    posting is provided "AS IS" with no warranties, and confers no rights.

    Monday, May 3, 2010 8:51 PM
    Moderator
  • Does your PDC Emulator has accurate time? If not, is there any reason you can not set the time manually (look into configuring it to sync up with an external time source - although this will likely require firewall changes)? If you are running DC as a VM, make sure that you disable automatic synchronization with the host (unless the host is synchronized with a reliable time source)

    hth
    Marcin

    • Marked as answer by cshiershc Friday, May 7, 2010 9:01 PM
    Monday, May 3, 2010 10:57 PM
  • Marcin,

    I think you may be right.  My DC server with the issue is the PDCe.  Everything currently uses it as the time server.  It was set to synchronize with the host.  I have since turned off that option and will see how it goes.

    I will update it once I am confidant it is resolved.

    My theory is I will disable this option for my to DCs and set my DCs and my hosts all to point to the same time server.

    Chris

    Tuesday, May 4, 2010 2:59 PM
  • Chris,

    configure your PDC Emulator to synch up with a reliable time source. For all other domain computers, use default time synchronization mechanism based on domain hierarchy...

    hth
    Marcin

    • Marked as answer by Bruce-Liu Thursday, May 6, 2010 7:08 AM
    Tuesday, May 4, 2010 3:01 PM
  • Thanks Marcin,

    Meant to reply sooner.  I turned off the DCs synching with the host server and ensure everything is set to synch with my PDCe.  Everything is back to normal.

    Thanks again!

    Chris

    Friday, May 7, 2010 9:02 PM