Synchronising time on domain computers

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Do computers on the domain automatically synchronise with the DC (Windows 2003) when you log on?

There are some computers at work where the time is a little off and I would have thought that logging off and on (and reboot) again would correct it but it doesn't. The time on the server was also corrected and only a manual sync from the command prompt works.

 

Define a little off? By default you're allowed a 5 minute skew before Kerberos causes you an issue.

 

The client computers were about 3 minutes behind the DC time. Anyhow, it seemed to have automatically synced to the DC time and I assume this is automatically done at set intervals. Set in group policy?

 

A default installation of AD and clients will result in the client computers requesting time syncs from their logon DC on a regular basis. There's very little need to modify this behavior unless you have atomic clocks that you wish to use or another third party time service. In these latter cases, a GPO can be used to publish alternative time keeping strategies for clients.

And in a default installation, DC's maintain time synchronization using a tree structure with a single DC at the top (running the PDCe role if I recall?) having to be the only one which should be configured to maintain time from, say, an internet time service provider (by default time.microsoft.com) and if internet access is blocked for the DC, an alternative can be configured in the CMD prompt if one doesn't want to use GPO's.

There's some useful articles on this if you do a little digging

 

AD is pretty crappy at keeping time in my experience. w32tm /resync I think to manually resync it.

It's a pain in the ass when you require time sensitive logging and such, I got so hacked off with it drifting at one point I scripted a registry hack customising the whole w32time service settings (client and server) and pushed it out so our servers would check in with our PDC every 10 mins or so. I'm sure there's a neater way of doing it via command line, but time (as it were) was off the essence.