Configure Windows Time Service in Active Directory
As Active Directory heavily depends on kerberos authentication, it is important to be sure the time in the domain is synchronised to all servers and workstations. If this is not the case different problems can occur, like not being able to logon to the domain.
In Windows 2003 the clients automatically sync the time with the Domain Controller which holds the PDC Emulator role. This server needs to be configured to get the time from a internet time server or with an external Reference Clock.
If your server needs to sync with a internet time server, be sure to allow traffic through UDP port 123 (NTP).
Change the following registry keys on your DC (PDC Emulator).
1. The value (REG_SZ) needs to be : NTP (not NT5DS)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type
2. The value (REG_DWORD) needs to be : 5 (not 10)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags
3. The value (REG_SZ) needs to have the IP-address of the internet time server or external Reference Clock.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\NtpServer
Restart the Time Service through the MMC or start a command prompt and type the following:
net stop w32time
net start w32time
If the time service is not synchronizing, you can log more information about the service by creating a debug file, as shown in KB 816043 (How to turn on debug logging in the Windows Time Service)
Comments
Post a comment
