#159156 - 2006-03-16 01:05 AM
Re: Time Server Q and A
|
Radimus
Moderator
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
that is funny you brought that up... I just configured my DC to be my domain time server 3 hours ago.
Using windows timeservice... why add one, when one it already built in.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters]
"LocalNTP"=dword:00000001
"Period"="24"
"type"="NTP"
"ReliableTimeSource"=dword:00000001
"NtpServer"="time.nist.gov time.windows.com"
"MaxAllowedClockErrInSecs"=dword:00000900
|
|
Top
|
|
|
|
|
#159159 - 2006-03-16 01:08 AM
Re: Time Server Q and A
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11631
Loc: CA
|
Quote:
"NtpServer"="time.nist.gov time.windows.com"
I'd pick some better or more redundant time sources. Those links are often down for us.
|
|
Top
|
|
|
|
#159163 - 2006-03-16 02:38 AM
Re: Time Server Q and A
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
|
We use Dillobits SNTPd for Windows for all critical application servers, and Windows Time for the non-critical systems. We have 3 statum-2 servers that sync from GPS receivers. Every router syncs to those 3 systems. The application servers and DCs sync to the routers, and the workstations and non-critical servers sync with the DCs.
We don't use Windows Time for our critical application servers because MS uses a derivative of NTP. The SNTP service we use syncs to +/-2ms, is fully configurable with regard to the sync rate and such, and has excellent logging. Windows Time is designed to be "good enough" for Kerberos, which requires a time tolerance of 5 minutes. If Windows Time is used exclusively, time between servers in the same subnet could vary up to 4 seconds (+/- 2 sec accuracy at sync) and up to 20 seconds between the farthest ends of a WAN. For our app servers, which must be no more than 0.5 seconds apart at opposite ends of the country, Windows Time was not "good enough". The approach you use will depend on your application. Windows Time is fine for workstations and most typical file/print & A/D purposes, although I am not personally happy with the lack of logging that is available compared to other products.
At home, I use a 3rd party SNTP service on the firewall, which syncs with public time sources in the northeast US.
The two AD-DC servers use the same SNTP service to sync with the firewall, and those SNTP services are set to "Ignore Not Sync'd" messages from the firewall. This way, the 2 DCs stay in sync with the firewall and with each other (+/- 2ms) even if I lose Internet connectivity. The remaining servers and workstations sync with the SNTP service running on the DCs. (I basically eliminated Windows Time on my home net.)
One word of caution - Windows will REFUSE to join a domain if the Windows Time service is removed! When the server or workstation is joined to the domain, the Windows Time service is started (even if it isn't actually used to set the time) during the domain joining process. Allow that to complete, then simply stop and disable Windows Time if you are using SNTP.
One more note regarding SNTP vs Windows Time.. I had a Kix app that compared the timestamp of a file on a remote system to a copy on the local system. Using Windows Time, the compare almost always failed - off by 1-3 seconds. When both servers were updated to SNTP, I have yet to have a miscompare unless they are off by an hour or more. (The master copy is updated, and the different times triggers a full directory sync.) Again - the decision of Windows Time vs SNTP depends on the time accuracy required by your application.
Glenn
PS - one more caution. Time is a tricky thing to deal with. We had a major issue a few years ago because the design of the system was linear. "A" got time from a GPS, "B" got time from "A", "C" from "B", and all the "D" systems sync'd with "C". When the GPS unit failed, "A" said "Not Sync'd" (which means "don't trust my time"). "B" knew it lost sync, so passed on the "not sync'd" message, and so on.. Instead of the "B" level servers being set to ignore the not sync'd message and keeping all the systems in sync with each other, all the systems decided not to trust the time source and use their internal clocks. These clocks had different drift rates, and after a few hours, systems were as much as 30 minutes off from one-another. The irony was that the level-A server was only off by 3 seconds - had the second-level servers been configured to always trust the local master time source, the entire network would have been in sync, and would have only been 3 seconds off from the real world.
This isn't something to be approached casually!
_________________________
Actually I am a Rocket Scientist! 
|
|
Top
|
|
|
|
|
#159166 - 2006-03-16 07:19 PM
Re: Time Server Q and A
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11631
Loc: CA
|
You could brute force it too, though not recommended 
I've used this for stand alone machines.
Code:
Function SetTimeServer($Peers,$Pos,$Neg,$Poll)
Dim $Key,$Set,$Admin
$Admin=IIf(InGroup(@WKSTA+'\'+SidToName('S-1-5-32-544'))-1+@INWIN=1,1,0)
;If user does not have Admin rights then quit.
If Not $Admin Exit 5 EndIf
$Key='HKLM\SYSTEM\CurrentControlSet\Services\W32Time\'
$Set=WriteValue($Key+'Parameters','Type','NTP',REG_SZ)
$Set=WriteValue($Key+'Config','AnnounceFlags',5,REG_DWORD)
$Set=WriteValue($Key+'TimeProviders\NtpClient','SpecialPollInterval',$Poll,REG_DWORD)
$Set=WriteValue($Key+'TimeProviders\NtpServer','Enabled',1,REG_DWORD)
$Set=WriteValue($Key+'Parameters','NtpServer',$Peers,REG_SZ)
$Set=WriteValue($Key+'Config','MaxPosPhaseCorrection',$Pos,REG_DWORD)
$Set=WriteValue($Key+'Config','MaxNegPhaseCorrection',$Neg,REG_DWORD)
SHELL '%comspec% /e:1024 /c net stop w32time >NUL 2>NUL'
SHELL '%comspec% /e:1024 /c net start w32time >NUL 2>NUL'
;The w32tm command does not appear to set the errorlevel.
;You will have to check it against another source to confirm success
SHELL '%comspec% /e:1024 /c w32tm /resync /rediscover >NUL 2>NUL'
EndFunction
|
|
Top
|
|
|
|
|
#159169 - 2006-03-16 11:43 PM
Re: Time Server Q and A
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11631
Loc: CA
|
Quote:
But this method still has the accuracy limitation of W32Time... 
Glenn
Yes, but that is still probably good enough for 99% of the Companies around the World.
|
|
Top
|
|
|
|
|
#173774 - 2007-02-08 05:40 PM
Re: Time Server Q and A
[Re: NTDOC]
|
Dugster
Fresh Scripter
Registered: 2006-12-12
Posts: 11
|
Hi,
I would like to be able to set the sntp as decribed above and restart the w32time service irrespective of whether users have admin rights or not. Do you think this is possible or will I have to set the sntp and then wait until next reboot?
Thanks as ever.
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 484 anonymous users online.
|
|
|
