Windows Server NTP Time Setup

Windows Server NTP Time Setup

^{Created: 2019-05-02 19:29:35 | Last modified: 2024-08-26 23:05:53}
^{Access: Read}^{| Views: 220}^{| Rating: N/A}^{| Tags: windows server ntp}
How to configure NTP on a Windows Server and update each of the active directory clients to use it

We have found that our Windows Server 2019 (Active Directory) time is out of sync causing each of the client machines to be out of sync too, here is the process to get it back into sync with the rest of the world and update each of the client workstations

Open a Power Shell and set which NTP server the server is to use

w32tm /config /manualpeerlist:pool.ntp.org /syncfromflags:MANUAL /update

Start and stop the services

Stop-Service w32time
Start-Service w32time

Now resync the time (do this on the local server, as well as the client machines, client machines should however update themselves over time)

w32tm /resync

You can query the configuration

w32tm /query /configuration

You can diagnose w32tm issues using the status option

w32tm /query /status

Example of all commands to change an NTP server

net stop w32time
w32tm /config /syncfromflags:manual /manualpeerlist:"pool.ntp.org"
net start w32time
w32tm /config /update
w32tm /resync /rediscover

To debug NTP, use the following command

w32tm /debug /enable /file:C:\windows\temp\w32timeDebug.log /size:10000000 /entries:400

Time Synchronization Schedule

You can modify the windows schedule to change when time is synchronized.

Open Task Scheduler -> Task Scheduler (Local) -> Task Scheduler Library -> Microsoft, -> Windows -> TimeSynchronization

Open the SynchronizeTime schedule and click on the Triggers tab and click New and select the schedule you wish to run the update task for and click OK

Fixes

When getting the error message on a domain controller and time is no longer syncing in your enviroment, an example from a client;

Event ID: 50
Message:The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself.

Fix

# On the domain controller
w32tm /config /syncfromflags:domhier /update

# Restart time server
net stop w32time
net start w32time

If the above doesn't work, when you get time skew on the domain controller and get the following message;

Event ID: 50
The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself.

Run the following;

w32tm.exe /config /syncfromflags:manual /manualpeerlist:pool.ntp.org,0x8 /reliable:yes /update

# Restart time server
net stop w32time
net start w32time

Windows Server GPO for NTP

Create a new group policy object and edit this policy, navigate to;
Computer Configuration -> Policies -> Administrative Templates -> System -> Windows Time Service -> Time Providers

Edit 'Configure Windows NTP Client'

Edit 'Enable Windows NTP Client'

You can make sure the GPO has been populated on the client machine by running the following;

gpupdate /force
gpresult /h C:\gpo.html

Query an NTP Server

With LInux, you can query an NTP server using the following commands

ntpdate -q pool.ntp.org