3

I have a Server 2008 R2 domain controller running in VM on Hyper-V that is 7 minutes fast which I need to fix. I understand that this maybe down to the DC running in VM's.

What I would like to know is how I can correct it?

I believe I can setup the DC to use a public/internet NTP server, but I don't know any or have any idea how to do. Also according to a few forums I may experience problems if the time is changed on the DC and that time is more than 3 minutes.

If anyone can help I would be very grateful!

stead1984
  • 577
  • 8
  • 16
  • 32

2 Answers2

9

On the domain controller holding the PDC Emulator flexible single-master operations (FSMO) role in the forest root domain of your Active Directory forest should have an external-to-the-forest time source specified. On every other DC, time synchronization should be handled by the "Windows Time" service automatically. The DCs in each domain will sync with their domain's PDC Emulator role-holder, and the PDC Emulator role-holders in each domain will synchronize with the forest root PDC Emulator role-holder.

Per this document from Microsoft, be sure that you've disabled time synchronization in Host Integration Services.

Follow the procedure here to locate the DC in your domain that holds the PDC Emulator role. If you have a single-domain environment, then the PDC Emulator role-holder should have an external-to-the-forest time source configured.

Microsoft offers some more detailed guidance here, but the gist of setting an external-to-the-forest time source is using the "NET TIME" command, run on the forest root PDC Emulator role-holder, to specify the NTP server:

NET TIME /setsntp:server-name-here

Be sure that you can resolve the NTP server's name and that your firewall passes NTP (UDP port 123).

Evan Anderson
  • 141,071
  • 19
  • 191
  • 328
  • I'm running a single domain with a single domain controller so all the roles would be on the same server. Just to confirm, I have to disable time synchronisation in Host Integration Services (what is that by the way? [do you mean Hyper-V Manager]). Then run the above command on the forest root PDC Emulator role-holder. Right? Could you tell me a reliable Internet-based NTP server? – stead1984 Dec 09 '09 at 15:51
  • Also what are the risks of changing time as I've read that the DC thinks it has gone back in time? Something to do with Kerberos? – stead1984 Dec 09 '09 at 16:19
  • My understanding is Kerberos complains if there is an excessive difference in the clocks on the server and the client(three minutes is the number I hear thrown around). Since your Server is the only DC, it should be the time server for the clients, so they should all change to match it at their next login/restart, so you wouldn't have any Kerberos ticket issues, other than potientially needing to restart the clients, or re-syncing the time on them with a net time command. – BillN Dec 09 '09 at 16:58
  • I'm still having problems with my time server being fast. The answer above did correct the problem but it seems to be back. The link below is a new posting I have made, one of the answers suggests to have the VM's time sync (or at least the DC) with the host and set the host up with NTP. http://serverfault.com/questions/97928/domain-controller-time-is-incorrect Also perhaps using a physical server running a Linux NTP server? – stead1984 Dec 30 '09 at 08:42
  • @stead1984 Older VMware Tools versions (not sure which ones) could only correct the time in the VM forward, which may be why you're fast. Current versions adjust time both ways. It is now safe to have your hypervisors sync to external servers via NTP, and have your VM's sync to the hypervisors via VMware Tools. – Martijn Heemels Jan 30 '12 at 22:42
1

In addition to setting up SNTP/Windows Time, You also need to disable time syncronization under integration services. If you don't, you'll have conflicts as to what is setting the time, the Hyper-V Host or the Windows Time service.

Here's an article describing the process. You might also want to take a look at Ben Armstrong's article The Domain Controller Dilemma. One of the comments specifically mentions DC's under Hyper-V and time syncronization.

Christopher_G_Lewis
  • 3,647
  • 21
  • 27