How to Configure Time in a Windows Active Directory Environment

• By g2
• April 26, 2016
• No Comments

Purpose

This article is meant to be used to configure time properly in a Windows Active Directory (AD) environment.
It is divided up by the roles of the Domain Controllers in a Windows AD environment

PDC Emulator

Run the following commands from an admin command prompt to set the PDC emulator to sync its time with an external time source.

w32tm /config /manualpeerlist:"pool.ntp.org,0x1" /syncfromflags:MANUAL
w32tm /config /update
w32tm /resync
w32tm /resync /rediscover
w32tm /query /source

VM PDC Emulator

Run these additional commands if your PDC emulator is running on a virtual machine. These commands allow the VM PDC to check for time more frequently. This is because hyper visors adjust the length of between “time ticks” which windows uses determine when it needs to check for time which causes the time to jump ahead in time.

reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config /v MaxAllowedPhaseOffset /t reg_dword /d 1 /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider /v Enabled /t reg_dword /d 0 /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient /v SpecialPollInterval /t reg_dword /d 120 /f
net stop w32time && net start w32time
Uncheck Time synchronization in Hyper-V, Settings, Integration Services

All Other DCs

Run the following commands from an admin command prompt.
reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters /v Type /t reg_sz /d NT5DS
w32tm /config /syncfromflags:DOMHIER /update
net stop w32time && net start w32time
w32tm /resync /rediscover /nowait
w32tm /query /source
GPO to Keep PDC Syncing with an externally time source

Create a WMI filtered GPO for the PDC to make sure the PDC always gets its time from an external time server per Microsoft Best Practice if the role should move to a new DC.

WMI Filter = Select * from Win32_ComputerSystem where DomainRole = 5

Create a new GPO with the following Settings linked to the Domain Controllers OU.
Computer Configuration\Policies\Administrative Templates\System\Windows Time Service\Time Providers
Configure Windows NTP Client = Enabled
NtpServer = pool.ntp.org,0x1
Type = NTP

Enable Windows NTP Client  = Enabled