ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Best Practice for Time Sync for Active Directory Domain Controllers

    IT Discussion
    windows active directory ntp sntp
    5
    41
    10.8k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      scottalanmiller @coliver
      last edited by

      @coliver said:

      @Dashrender said:

      Soooo what is the BP for setting time in a virtualized environment? Should the VM's get their time from the host OS, or should they pull it direct from an online time source?

      I know with Windows it's a bit more complex.

      Should the PDC emulator pull time from the host server (in my case ESXi - for now) or should it pull from the internet?

      Microsoft recommends that you turn off time synchronization for Domain Controllers. Not sure about generic servers.

      Generic ones get it from the DCs, in those cases.

      C D 2 Replies Last reply Reply Quote 0
      • S
        scottalanmiller @Dashrender
        last edited by

        @Dashrender said:

        Should the PDC emulator pull time from the host server (in my case ESXi - for now) or should it pull from the internet?

        Where is ESXi getting it from?

        D 1 Reply Last reply Reply Quote 0
        • C
          coliver @scottalanmiller
          last edited by

          @scottalanmiller said:

          @coliver said:

          @Dashrender said:

          Soooo what is the BP for setting time in a virtualized environment? Should the VM's get their time from the host OS, or should they pull it direct from an online time source?

          I know with Windows it's a bit more complex.

          Should the PDC emulator pull time from the host server (in my case ESXi - for now) or should it pull from the internet?

          Microsoft recommends that you turn off time synchronization for Domain Controllers. Not sure about generic servers.

          Generic ones get it from the DCs, in those cases.

          So would the hypervisors? If that is the case just turning it off for DCs should be enough.

          S 1 Reply Last reply Reply Quote 0
          • D
            Dashrender @scottalanmiller
            last edited by

            @scottalanmiller said:

            @Dashrender said:

            Should the PDC emulator pull time from the host server (in my case ESXi - for now) or should it pull from the internet?

            Where is ESXi getting it from?

            Let's assume the cloud.

            1 Reply Last reply Reply Quote 0
            • S
              scottalanmiller @coliver
              last edited by

              @coliver said:

              @scottalanmiller said:

              @coliver said:

              @Dashrender said:

              Soooo what is the BP for setting time in a virtualized environment? Should the VM's get their time from the host OS, or should they pull it direct from an online time source?

              I know with Windows it's a bit more complex.

              Should the PDC emulator pull time from the host server (in my case ESXi - for now) or should it pull from the internet?

              Microsoft recommends that you turn off time synchronization for Domain Controllers. Not sure about generic servers.

              Generic ones get it from the DCs, in those cases.

              So would the hypervisors? If that is the case just turning it off for DCs should be enough.

              Only if it is HyperV. Windows doesn't talk NTP.

              C 1 Reply Last reply Reply Quote 0
              • D
                Dashrender @scottalanmiller
                last edited by

                @scottalanmiller said:

                @coliver said:

                @Dashrender said:

                Soooo what is the BP for setting time in a virtualized environment? Should the VM's get their time from the host OS, or should they pull it direct from an online time source?

                I know with Windows it's a bit more complex.

                Should the PDC emulator pull time from the host server (in my case ESXi - for now) or should it pull from the internet?

                Microsoft recommends that you turn off time synchronization for Domain Controllers. Not sure about generic servers.

                Generic ones get it from the DCs, in those cases.

                Exactly, the rest of the domain will get it's time from the PDC emulator.

                Question, is it OK to shorten PDC emulator to PDCe?

                1 Reply Last reply Reply Quote 0
                • C
                  coliver @scottalanmiller
                  last edited by

                  @scottalanmiller said:

                  @coliver said:

                  @scottalanmiller said:

                  @coliver said:

                  @Dashrender said:

                  Soooo what is the BP for setting time in a virtualized environment? Should the VM's get their time from the host OS, or should they pull it direct from an online time source?

                  I know with Windows it's a bit more complex.

                  Should the PDC emulator pull time from the host server (in my case ESXi - for now) or should it pull from the internet?

                  Microsoft recommends that you turn off time synchronization for Domain Controllers. Not sure about generic servers.

                  Generic ones get it from the DCs, in those cases.

                  So would the hypervisors? If that is the case just turning it off for DCs should be enough.

                  Only if it is HyperV. Windows doesn't talk NTP.

                  That makes sense in the Microsoft kind of way...

                  1 Reply Last reply Reply Quote 0
                  • D
                    Dashrender
                    last edited by

                    I recall when I setup a VM ages ago that VMWare could be the time source for the VMs. I though it was set to work like the BIOS clock.

                    1 Reply Last reply Reply Quote 0
                    • D
                      Dashrender
                      last edited by

                      My current PDC emulator is set to pull time from the BIOS clock

                       C:\Windows\system32>w32tm /query /source
                       Local CMOS Clock
                      

                      This hasn't been an issue for years, yet someone called this morning and reported that the phones and the computers didn't match timewise, so I'm looking into it.

                      1 Reply Last reply Reply Quote 0
                      • S
                        scottalanmiller
                        last edited by

                        I'm going to turn this into its own topic.

                        D 1 Reply Last reply Reply Quote 0
                        • D
                          Dashrender @scottalanmiller
                          last edited by

                          @scottalanmiller said:

                          I'm going to turn this into its own topic.

                          OK
                          🙂

                          1 Reply Last reply Reply Quote 0
                          • D
                            Dashrender
                            last edited by

                            I looked at the settings in ESXi, it was not set to pull time from an external source. I have corrected that, and enabled NTP.

                            ESXi is now correct on it's time, now to force the PDC emulator to sync.. and eventually all windows clients will sync as well.

                            1 Reply Last reply Reply Quote 1
                            • D
                              Dashrender
                              last edited by

                              OK tried a

                               w32tm /resync
                              

                              and got back

                               The computer did not resync because no time data was available.
                              
                              C S 2 Replies Last reply Reply Quote 0
                              • C
                                coliver @Dashrender
                                last edited by

                                @Dashrender said:

                                OK tried a

                                 w32tm /resync
                                

                                and got back

                                 The computer did not resync because no time data was available.
                                

                                If I remember correctly it actually uses VMWare tools to do the syncing between the computers and the hypervisor.

                                S 1 Reply Last reply Reply Quote 1
                                • S
                                  scottalanmiller @coliver
                                  last edited by

                                  @coliver said:

                                  @Dashrender said:

                                  OK tried a

                                   w32tm /resync
                                  

                                  and got back

                                   The computer did not resync because no time data was available.
                                  

                                  If I remember correctly it actually uses VMWare tools to do the syncing between the computers and the hypervisor.

                                  It you are on VMware ESXi, then the VMware tools are the only possible mechanism for that.

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    Dashrender
                                    last edited by

                                    OK, I have VM Tools running - do I just wait and see?

                                    S 1 Reply Last reply Reply Quote 0
                                    • S
                                      scottalanmiller @Dashrender
                                      last edited by

                                      @Dashrender said:

                                      OK tried a

                                       w32tm /resync
                                      

                                      and got back

                                       The computer did not resync because no time data was available.
                                      

                                      What time source do you have set? w32tm requires an SNTP source to sync to, what SNTP server do you have it talking to?

                                      D 1 Reply Last reply Reply Quote 0
                                      • D
                                        Dashrender @scottalanmiller
                                        last edited by

                                        @scottalanmiller said:

                                        @Dashrender said:

                                        OK tried a

                                         w32tm /resync
                                        

                                        and got back

                                         The computer did not resync because no time data was available.
                                        

                                        What time source do you have set? w32tm requires an SNTP source to sync to, what SNTP server do you have it talking to?

                                        I don't, it's currently pulling from

                                         Local CMOS Clock
                                        
                                        S 1 Reply Last reply Reply Quote 0
                                        • S
                                          scottalanmiller @Dashrender
                                          last edited by

                                          @Dashrender said:

                                          OK, I have VM Tools running - do I just wait and see?

                                          There is no sync involved. You are mixing the concepts of NTP/SNTP with a source server and actually controlling the system's clock.

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            scottalanmiller @Dashrender
                                            last edited by

                                            @Dashrender said:

                                            @scottalanmiller said:

                                            @Dashrender said:

                                            OK tried a

                                             w32tm /resync
                                            

                                            and got back

                                             The computer did not resync because no time data was available.
                                            

                                            What time source do you have set? w32tm requires an SNTP source to sync to, what SNTP server do you have it talking to?

                                            I don't, it's currently pulling from

                                             Local CMOS Clock
                                            

                                            Right, which is unrelated to time syncing.

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 1 / 3
                                            • First post
                                              Last post