The primary difference between the two is that SNTP does not have the error management and complex filtering systems that NTP provides. The time service in Windows NT Server 4.
For example, if your domain is configured to synchronize time by using the domain hierarchy-based method of synchronization and you want computers in the domain hierarchy to synchronize time with a Windows NT 4.
Windows NT 4. Therefore, to ensure accurate time synchronization across your network, it is recommended that you upgrade any Windows NT 4. The Windows Time service is designed to synchronize the clocks of computers on a network.
The network time synchronization process, also called time convergence, occurs throughout a network as each computer accesses time from a more accurate time server. Time convergence involves a process by which an authoritative server provides the current time to client computers in the form of NTP packets. The information provided within a packet indicates whether an adjustment needs to be made to the computer's current clock time so that it is synchronized with the more accurate server.
As part of the time convergence process, domain members attempt to synchronize time with any domain controller located in the same domain. If the computer is a domain controller, it attempts to synchronize with a more authoritative domain controller. Computers running Windows XP Home Edition or computers that are not joined to a domain do not attempt to synchronize with the domain hierarchy, but are configured by default to obtain time from time.
To establish a computer running Windows Server as authoritative, the computer must be configured to be a reliable time source. By default, the first domain controller that is installed on a Windows Server domain is automatically configured to be a reliable time source.
Because it is the authoritative computer for the domain, it must be configured to synchronize with an external time source rather than with the domain hierarchy. Also by default, all other Windows Server domain members are configured to synchronize with the domain hierarchy. After you have established a Windows Server network, you can configure the Windows Time service to use one of the following options for synchronization:.
Synchronization that is based on a domain hierarchy uses the AD DS domain hierarchy to find a reliable source with which to synchronize time. Based on domain hierarchy, the Windows Time service determines the accuracy of each time server. In a Windows Server forest, the computer that holds the primary domain controller PDC emulator operations master role, located in the forest root domain, holds the position of best time source, unless another reliable time source has been configured.
The following figure illustrates a path of time synchronization between computers in a domain hierarchy. A computer that is configured to be a reliable time source is identified as the root of the time service. The root of the time service is the authoritative server for the domain and typically is configured to retrieve time from an external NTP server or hardware device. A time server can be configured as a reliable time source to optimize how time is transferred throughout the domain hierarchy.
If a domain controller is configured to be a reliable time source, Net Logon service announces that domain controller as a reliable time source when it logs on to the network. When other domain controllers look for a time source to synchronize with, they choose a reliable source first if one is available.
A cycle in the synchronization network occurs when time remains consistent between a group of domain controllers and the same time is shared between them continuously without a resynchronization with another reliable time source.
The Windows Time service's time source selection algorithm is designed to protect against these types of problems. If the computer is not a member of a domain, it must be configured to synchronize with a specified time source.
If the computer is a member server or workstation within a domain, by default, it follows the AD DS hierarchy and synchronizes its time with a domain controller in its local domain that is currently running the Windows Time service.
If the computer is a domain controller, it makes up to six queries to locate another domain controller to synchronize with. Each query is designed to identify a time source with certain attributes, such as a type of domain controller, a particular location, and whether or not it is a reliable time source. The time source must also adhere to the following constraints:. A PDC emulator can synchronize with a reliable time source in its own domain or any domain controller in the parent domain.
If the domain controller is not able to synchronize with the type of domain controller that it is querying, the query is not made. The domain controller knows which type of computer it can obtain time from before it makes the query. For example, a local PDC emulator does not attempt to query numbers three or six because a domain controller does not attempt to synchronize with itself.
The following table lists the queries that a domain controller makes to find a time source and the order in which the queries are made. A domain controller does not attempt to synchronize with itself. Each query returns a list of domain controllers that can be used as a time source. Windows Time assigns each domain controller that is queried a score based on the reliability and location of the domain controller.
The following table lists the scores assigned by Windows Time to each type of domain controller. When the Windows Time service determines that it has identified the domain controller with the best possible score, no more queries are made. The scores assigned by the time service are cumulative, which means that a PDC emulator located in the same site receives a score of nine. If the root of the time service is not configured to synchronize with an external source, the internal hardware clock of the computer governs the time.
Manually-specified synchronization enables you to designate a single peer or list of peers from which a computer obtains time. If the computer is not a member of a domain, it must be manually configured to synchronize with a specified time source. A computer that is a member of a domain is configured by default to synchronize from the domain hierarchy, manually-specified synchronization is most useful for the forest root of the domain or for computers that are not joined to a domain.
Manually specifying an external NTP server to synchronize with the authoritative computer for your domain provides reliable time. However, configuring the authoritative computer for your domain to synchronize with a hardware clock is actually a better solution for providing the most accurate, secure time to your domain.
Manually-specified time sources are not authenticated unless a specific time provider is written for them, and they are therefore vulnerable to attackers. Also, if a computer synchronizes with a manually-specified source rather than its authenticating domain controller, the two computers might be out of synchronization, causing Kerberos authentication to fail.
This might cause other actions requiring network authentication to fail, such as printing or file sharing. If only the forest root is configured to synchronize with an external source, all other computers within the forest remain synchronized with each other, making replay attacks difficult. The "all available synchronization mechanisms" option is the most valuable synchronization method for users on a network.
This method allows synchronization with the domain hierarchy and may also provide an alternate time source if the domain hierarchy becomes unavailable, depending on the configuration. If the client is unable to synchronize time with the domain hierarchy, the time source automatically falls back to the time source specified by the NtpServer setting.
This method of synchronization is most likely to provide accurate time to clients. There are certain situations in which you will want to stop a computer from synchronizing its time. For example, if a computer attempts to synchronize from a time source on the Internet or from another site over a WAN by means of a dial-up connection, it can incur costly telephone charges.
Thank you very much for this article. It was as second link in Google search for the request — pool. Thank you for your comment. Its nice to be re-authored and thank you also for linking back to my original post. Your email address will not be published. Save my name, email, and website in this browser for the next time I comment.
Steps to change to alternative time server Stop the W32Time service. Edit the config. For operational master domain controllers, make a reliable time source. Start the W32Time service. Your advise in this regards is highly appreciated. Thanks a lot, it works well, although i had to use 0. Unless you remove spaces and the quotes. When querried, still shows 0. I just had to paste the whole command but deleted and re-typed each double-quote individually.
No need to wrap the whole switch in quotes. Hi…, possible to sync time with linux server via commend. Like windows with linux time sync. AD1 and AD2 have same time on both machine but is not the right time.
All of the clients are synchronizing with either AD1 or AD2 not sure which from the two. Here are the list of things i need help with. When i change the time manually on AD1 or AD2 it gets changed back to the wrong time which is 10min ahead of the actual time. How to fix? How to check which AD is supplying the time sync to the clients? First, locate your PDC server as described in step 1. The other domain controllers should automatically pick up the right time.
If not, please refer to the following how-to guide on time configuration in a Windows Active Directory environment. All the command completed successfully.
I had to take the spaces out between the time servers for Server Every other guide used reg edits so this was much easier…. Thanks a lot. I have found this post very useful. I used it for two different networks. One WinR2 and the other Windows Server. I did retype the double quotes just in case otherwise the whole thing worked as is provided in here with out any problem. This was great thanks for the post!
What do you if you have an external masterclock supplying us with the universal time clock and his clock has an ip and with in a certain subnet. In that case you just point your PDC to that IP address so it will sync its time with your external masterclock. Home About Contact Privacy. First, locate your PDC Server. Tested on Windows Server R2 Build Z Be Sociable, Share! The command put the whole string into the registry, quotes and all.
My Win2k8 R2 needed this.
0コメント