Skip to content
IT // Adventures

Configure Time Synchronization via NTP for Domain Controllers

Updated 19 June 20171 min read
Contents

The Primary Domain Controller (PDC) must provide a reliable time source for the Windows domain. The easiest way to achieve this is to use an NTP server pool.

NTP Server Pools

For redundancy, public NTP servers are addressed through so-called “NTP pools”. Domain controllers should use at least 2 of these pools as their time source:

  • 0.at.pool.ntp.org
  • 1.at.pool.ntp.org
  • 2.at.pool.ntp.org
  • 3.at.pool.ntp.org

Update #2: Windows Server 2016

Windows Server 2016 ships with a whole series of improvements to the NTP service, but still uses w32tm for configuration. With regard to domain controllers in particular, Microsoft has published a detailed best practice document: Windows Server 2016 Accurate Time

Update: Windows Server 2008 & 2012

Since Windows Server 2008, the “w32tm” tool can be used instead of the registry hack:

w32tm /config /manualpeerlist:"<Peers>" /syncfromflags:manual /reliable:yes /update

Enter the peers in double quotes, separated by spaces. Example: “0.at.pool.ntp.org 1.at.pool.ntp.org”

Note: if the domain controller runs virtualized on Hyper-V, time synchronization with the Hyper-V host should be disabled in the VM’s properties (under “Integration Services”)!

Windows Server 2003

The time service can be configured by setting the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type = NTP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags = 5
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer\Enabled = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\NtpServer\NTPServer = <Peers>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient\SpecialPollInterval = 900
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\MaxPosPhaseCorrection = 1800
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\MaxPosPhaseCorrection = 1800

Enter the peers separated by spaces and with the suffix “,0x1”. (Without the suffix, the polling interval is ignored.) Example: 0.at.pool.ntp.org,0x1 1.at.pool.ntp.org,0x1

Then restart the Windows time service:

net stop w32time && net start w32time

Sources