Configure NTP Time Sync in Active Directory Using Group Policy

9.2K

Time accuracy between workstations/member servers and domain controllers is a key requirement for the proper functioning of the Active Directory domain.

In order for the time sync to work properly in AD, the administrator needs to configure the PDC domain controller to synchronize its time with an authoritative NTP time source. The remaining DCs and the workstations will synchronize their time according to a domain hierarchy

In some cases, it may also be necessary for the administrator to configure the NTP time sync settings in the domain using Group Policies.

How Does Time Sync Work in an AD Domain?

In the AD environment, the time synchronization is performed according to a strict domain hierarchy:

• Workstations and member servers synchronize their time with the DCs that are closest to them;
• DCs synchronize their time with the single DC assigned the FSMO Primary Domain Controller Emulator (PDC) role;
• PDC domain controller is the main time source in the domain. By default, an unconfigured PDC may use the local hardware clock as its time source;
• The PDC emulators in the child domains synchronize their time with the DCs from the parent domain;
• The PDC emulator in the root domain is the main time source for the entire AD forest.

A typical hierarchy of time sources in an AD DS domain is shown in the following diagram:

In AD, time sync is typically configured using Group Policy in production environments.

We recommend you to use manual configuration of the PDC emulator primarily for:

• initial setup
• testing
• troubleshooting

In the sections below you will find both approaches covered.

Step 1: Configure Time Sync on the PDC Emulator (Manual Method)

In this section, we will show you how to manually configure time sync on the PDC emulator using command-line tools.

According to Microsoft’s best practices, an administrator must enable the root PDC to sync its time with an external NTP time source.

Locate the domain controller with the PDC role in the forest root domain using the command:

Get-ADDomain|select pdcemulator

Check Current Time Source with w32tm

Connect to the PDC and check the current time source:

w32tm /query /source

The following outputs are possible:

• Local CMOS Clock — means that the time source on this server is its local hardware clock (CMOS)
• VM IC Time Synchronization Provider — if a virtualized domain controller is used, it syncs its time with the hypervisor host

Selecting External NTP Servers

Obtain the names or IP addresses of the authoritative external time sources (NTP providers) to sync the time with. It is preferable to use public NTP servers from NTP Pool Project or your ISP’s NTP servers.

Go to https://www.ntppool.org, find your location and copy the name of the NTP server.

Check if the selected external NTP server is accessible from the PDC (UDP port 123 is used for connection):

w32tm /stripchart /computer:0.us.pool.ntp.org

Sync time

Run the following commands on the PDC emulator in order to configure external time sync.

Enable time synchronization on the PDC host with an external NTP source:

net stop w32time

w32tm /config /syncfromflags:manual /manualpeerlist:"0.us.pool.ntp.org,0x8 1.us.pool.ntp.org,0x8 2.us.pool.ntp.org,0x8 3.us.pool.ntp.org,0x8"

w32tm /config /reliable:yes

w32tm /config /update

net start w32time

Note that the 0x8 flag configures the manually specified peer to use Client mode. If you want Windows Time to use the SpecialPollInterval value for polling manually configured peers, use the 0x1 (SpecialInterval) flag.

Sync time with NTP server:

w32tm /resync

Check your current configuration:

w32tm /query /configuration

Check the current NTP client settings:

w32tm /query /source

Run the command:

w32tm /monitor

This command displays time offsets and sync status for DCs.

Reset other DCs in domain

To reset other DCs in a domain to the default time sync scheme, use the command:

w32tm /config /syncfromflags:DOMHIER /update

Tip. If something does not work, try to restart the Windows Time service and reset its configuration:

net stop w32time

w32tm.exe /unregister

w32tm.exe /register

net start w32time

Note. The forest root domain PDC emulator is the only host in Active Directory that should have NTP as its time provider.

Step 2: Configure Time Sync Using Group Policy (Recommended)

Note that in production environments we recommend you to configure time sync using Group Policy instead of manual config. This ensures consistency and automatically applies settings when the PDC role changes.

In order to ensure that the current PDC emulator always uses an external NTP source, configure these settings through Group Policy.

1. Open the Group Policy Management Console (GPMC.msc);
2. Select the WMI Filters section and create a new WMI filter with the name Filter PDC Emulator and the following WMI query in the root\CIMv2 namespace Select * from Win32_ComputerSystem where DomainRole = 5

   

3. This WMI filter is used to select the DC holding the PDC role.
4. Create a new GPO and link it to the AD OU named Domain Controllers;
   

   

5. Edit this GPO. Navigate to Computer Configuration > Administrative Templates > System > Windows Time Service
6. Enable the policy Global Configuration Settings and set AnnounceFlags to 5.

   

7. This configures the domain controller to advertise itself as a reliable time server.
8. Then expand the Time Providers section in the GPO editor.
9. Enable the following policy options:
   Configure Windows NTP Client: Enabled (policy settings are described below);
   Enable Windows NTP Client: Enabled;
   Enable Windows NTP Server: Enabled.
   

   

10. Specify the following settings in Configure Windows NTP Client policy:
    NtpServer: us.pool.ntp.org,0x8 1.us.pool.ntp.org,0x8 2.us.pool.ntp.org,0x8 3.us.pool.ntp.org,0x8;
    Type: NTP;
    CrossSiteSyncFlags: 2;
    ResolvePeerBackoffMinutes: 15;
    ResolvePeerBackoffMaxTimes: 7;
    SpecialPollInterval: 1024;
    EventLogFlags: 0.
    

    

11. Assign the WMI filter “Filter PDC Emulator” that you created earlier to the GPO.

    

12. Increase the priority of your GPO in the GPMC by moving it above the Default Domain Controller Policy in the link order list;
    

    

13. Allow outbound UDP 123 from the forest root PDC emulator to approved external NTP servers.
14. After that run the command:
    gpupdate /force
15. After applying GPO, you should verify the time sync config on the PDC:
    w32tm /query /source
    w32tm /query /status
    w32tm /monitor

Note. Never set NT5DS as the server type in the GPO for the PDC emulator! Only NTP should be set here. NT5DS means that sync is based on the domain hierarchy, which is not suitable for the PDC emulator that must use an external time source.

Advanced: Configure Client Time Sync (Optional)

Keep in mind that the following scenarios are optional and only required in specific environments.

By default, domain computers synchronize their time with domain controllers according to the domain hierarchy (option Nt5DS). This time sync scheme works correctly in most cases and requires no further configuration.

In case you are experiencing problems with time sync on domain clients, you can try specifying the time server directly on clients using GPO:

1. Create a new GPO and assign it to the OU with computers;
2. Navigate to Computer Configuration > Administrative Templates > System > Windows Time Service > Time Providers and enable the policy Configure Windows NTP Client.

   

3. Specify your domain name (preferred) or IP address/FQDN of the PDC as the NTP server.

Note that when Type is set to NT5DS, the NtpServer value is ignored (clients will follow the domain hierarchy). You should specify NtpServer only when Type is set to NTP.

Set Type: NT5DS
CrossSiteSyncFlags: 2
ResolvePeerBackoffMinutes: 15
ResolvePeerBackoffMaxTimes: 7
SpecialPollInterval: 3600
EventLogFlags: 0

Update Group Policy settings on the clients and check the received time sync settings as described above. By default, the domain clients synchronize their clocks once per hour (3,600 seconds).

Advanced: Virtual Machine Time Sync Considerations

1. You should consider disabling hypervisor time sync on DCs. This can be achieved by creating a special registry parameter using the GPO.
2. Navigate to Computer Configuration > Preferences > Windows Settings > Registry > New > Registry Item
3. Create a reg item with the following settings:
   Action: Update
   Hive: HKEY_LOCAL_MACHINE
   Key Path: SYSTEM\ CurrentControlSet\ Services\ W32Time\ TimeProviders\ VMICTimeProvider
   Value Name: Enabled
   Value Type: REG_DWORD
   Value Data: 0

In some cases, you can manually sync the client time with Domain Controller.

Disable CMOS and Hypervisor Time Sync

In case your DCs/clients are VMs, you should also disable time sync with the hypervisor to avoid time drift and conflicts.

Disable time synch with the hypervisor (VM IC Time Provider):

Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider -Name Enabled -Value 0

Restart the W32Time service on PDC:

Restart-Service "Windows Time" -force

On virtualized domain computers, disable the time sync with the hypervisor in the VM properties.

• Hyper-V: disable the Time Synchronization option under Integration Services
• VMware ESXi: edit VM settings > VM Options > VMware Tools > Time, uncheck the option Synchronize guest time with host
  

  

Wrapping up

In Active Directory, proper time sync relies on a single authoritative time source: the PDC emulator in the root domain.

For most environments we recommend you to:

• Configure the PDC to sync with an external NTP source
• Allow all other systems to follow the domain hierarchy (NT5DS)

You can use Group Policy to ensure consistency and avoid config drift across DCs.