Computers on domain refusing to fetch time from new PDC

Posted by johnnydotexe@reddit | sysadmin | View on Reddit | 13 comments

Currently working on upgrading a client's old Server 2012 DC and APP VMs to new 2022 VMs. Have the new DC added to the domain, promoted, FSMO roles transferred and confirmed, configured external NTP source on the new PDC, but having trouble getting all other devices on the network to stop using the old PDC as the "source", shown when I run *w32tm /query /status* on them. Checked google first, getting all sorts of mixed info and commands to try and no luck so far...just looking for a no BS/best practice way to get time working properly on this domain.

Reply to Post

13 Comments

[-]

Rivereye@reddit

If the old PDC Emulator is still a Domain Controller, it is a valid time source for your domain. Member Servers and Workstations can pull from any Domain Controller on the network. Your Domain Controllers in turn pull time from the PDC Emulator. Based on what I am reading, your environment is working the way Microsoft intend for it to work from a time stamp standpoint. Source: [https://learn.microsoft.com/en-us/services-hub/unified/health/remediation-steps-ad/configure-the-root-pdc-with-an-authoritative-time-source-and-avoid-widespread-time-skew](https://learn.microsoft.com/en-us/services-hub/unified/health/remediation-steps-ad/configure-the-root-pdc-with-an-authoritative-time-source-and-avoid-widespread-time-skew) >By default, all computers and devices on a domain synchronize system time using the domain hierarchy. Domain members synchronize time with domain controllers, which in turn synchronize time with the domain controller running the PDC emulator role. The PDC emulator of the forest root domain is at the top of the domain hierarchy, and as such configuring this domain controller to synchronize time with the domain hierarchy is invalid. The Windows Time Service warns you of this condition by writing event ID 12 to the Windows event log from the W32Time event source.

[-]

johnnydotexe@reddit (OP)

I ran a series of commands on the PDC to set an external NTP source, and set it as domheir, but machines are still pulling time from the old PDC even after a resync. My concern is what will happen once that old PDC is decommissioned in a few weeks.

[-]

jtheh@reddit

NT5DS chooses the next available time source automatically - no need to change the default configuration of clients or member servers. the query order is like: parent DC > local DC > local PDCe > and then the same with other sites if available

[-]

ramuser12258@reddit

Force all domain-joined computers to resync their time to make sure they are aligned with the new PDC: <POWERSHELL> w32tm /resync

[-]

johnnydotexe@reddit (OP)

Did that on one of the DHCP-enabled VMs in the environment, still pulling from the old PDC.

[-]

210Matt@reddit

have you updated DHCP?

[-]

johnnydotexe@reddit (OP)

I did that after the fact, once I got the DNS Server role installed on the new PDC. Does this affect which DC the domain-joined clients fetch time from?

[-]

210Matt@reddit

NTP server is one of the thing you set in DHCP to tell clients where to get time from

[-]

Gumbyohson@reddit

In an AD domain for AD joined machines it's not. NT5DS handles it if it's setup right.

[-]

trogstrogs@reddit

Tangentially related, while you're poking around with NTP stuff, make sure to disable secure time seeding [https://www.reddit.com/r/sysadmin/comments/18muhrs/secure\_time\_seeding\_a\_future\_or\_past\_pain\_in\_the/](https://www.reddit.com/r/sysadmin/comments/18muhrs/secure_time_seeding_a_future_or_past_pain_in_the/)

[-]

TheNewBBS@reddit

Maybe not super useful in your current situation, but for anyone who wants a "set it and forget it" time configuration for your domain(s): open 123/UDP from all your DCs to your time source, configure the following settings on a GPO that only affects the Domain Controllers OU, then remove all NTP settings from all group policies and servers where it's been configured manually. **Location**: Computer Configuration/Policies/Administrative Templates/System/Windows Time Service/Time Providers **Key**: Enable Windows NTP Client **Value**: Enabled **Key**: Configure Windows NT Client **Values** -Enabled **-Ntp Server**: A comma-separated list (with no spaces!) of the hostnames or IPs of your time sources **-Type**: NTP **-CrossSiteSyncFlags**: 2 I implemented this configuration in all our AD domains roughly a decade ago (was probably around 10 back then, currently 30+), and we haven't had a time issue since. It's so nice to never have to manually configure time settings on DCs.

[-]

somephanguy@reddit

There are some special things to do when it's a new PDC. When you configured the external time source on the new PDC, did you set it as an NTP source, and mark the PDC as "authoritative" ? (AnnounceFlag registry key). - [https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/configure-authoritative-time-server](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/configure-authoritative-time-server) In this article, check steps 1 through 5 under Suggested Actions as well - [https://learn.microsoft.com/en-us/services-hub/unified/health/remediation-steps-ad/configure-the-root-pdc-with-an-authoritative-time-source-and-avoid-widespread-time-skew](https://learn.microsoft.com/en-us/services-hub/unified/health/remediation-steps-ad/configure-the-root-pdc-with-an-authoritative-time-source-and-avoid-widespread-time-skew) Last piece of advice is to give it some time(no pun intended) .. sometimes time issues need time to work themselves out, but I think if you verify the announceflag is set, and you have the external source defined as NTP, it should work.

[-]

johnnydotexe@reddit (OP)

Ran out of time today to work on this, but will certainly give your steps a try tomorrow. Thank you!