Configure windows ntp client gpo

Синхронизация времени в домене Active Directory критически важна для корректного функционирования сервисов и механизмов безопасности. Если в домене не настроена четкач схема синхронизации времени, это может вызвать проблемы с аутентификацией, работой криптографических протоколов, сертификатов при взаимодействии со внутренними и внешними системами. Так, например, Kerberos аутентификация требует, чтобы время между клиентом и сервером не отличалась более чем на пять минут. В этой статье, мы рассмотрим, как должна работать синхронизация времени в домене AD, и как настроить синхронизацию контроллера домена с внешним источником точного времени (NTP).

Как работает синхронизация времени в домене AD?

Схема синхронизации времени в домене Active Directory имеет строгую иерархию:

• Главным источником времени в домене является контроллер домена с FSMO ролью эмулятора PDC.
• С PDC синхронизируют время все остальные контроллеры домена.
• Рядовые сервера и рабочие станции синхронизируют свое время с ближайшими DC согласно топологии AD (по умолчанию компьютеры Windows синхронизируют время внешним
  time.windows.com
  , но после добавления в домен синхронизация выполняется согласно иерархии домена)

Картинка с сайта: winitpro.ru

Источник

Для обеспечения точного времени на всех компьютерах домена, нужно настроить синхронизацию PDC с неким внешним источником точного времени по протоколу NTP.

Чтобы определить имя контроллера домена, на котором запущена FSMO роль эмулятора PDC, выполните PowerShell команду:

Get-ADDomain | Select-Object PDCEmulator

Картинка с сайта: winitpro.ru

Ручная настройка синхронизация времени контроллера домена PDC с внешним NTP источником

По умолчанию PDC синхронизирует время с аппаратными часами материнской платы физического сервера, на котором он запущен. Это можно проверить, выполнив на нем команду:

w32tm /query /source

Local CMOS Clock
указывает, что в качестве источника времени используются локальные часы. При этом в логе Event Viewe на PDC будет регистрироваться событие Event ID 12 от Time-Service:

Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.

Картинка с сайта: winitpro.ru

Если DC запущен на виртуальной машине, в настройках которой включена синхронизация времени с хостом (гипервизором), эта команда вернет:

VM IC Time Synchronization Provider

Поэтому для всех DC нужно отключить синхронизацию времени в настройках ВМ, или запретить DC получать время с хоста, создав параметр реестра:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\VMICTimeProvider /v Enabled /t REG_DWORD /d 0 /f

Перенастроим настройки Windows Time на PDC так, чтобы он использовал в качестве источника времени внешний NTP сервер. В качестве источника времени можно использовать ближайшие к вам сервера NTP из пула проекта https://www.ntppool.org

Для России это будут сервера 0.ru.pool.ntp.org, 1.ru.pool.ntp.org и 2.ru.pool.ntp.org

Проверьте с PDC эмулятора, что доступ к этим NTP серверам доступен (и порт 123/UDP не блокируется файерволами):

w32tm /stripchart /computer:0.ru.pool.ntp.org

Картинка с сайта: winitpro.ru

Если вы получили ответ от NTP сервера, можно задать эти внешние сервера в качестве источников времени для Primary DC. Выполните команды:

net stop w32time
w32tm /config /syncfromflags:manual /manualpeerlist:"0.ru.pool.ntp.org,0x8 1.ru.pool.ntp.org,0x8 3.ru.pool.ntp.org,0x8 4.ru.pool.ntp.org,0x8"


w32tm /config /reliable:yes
net start w32time
w32tm /config /update

Выполните синхронизацию времени с NTP:

w32tm /resync

Проверьте, что теперь источником времени на PDC является внешние NTP сервера:

w32tm /query /configuration

Картинка с сайта: winitpro.ru

Настройка групповой политики для синхронизации времени PDC с NTP

Так как роль эмулятора PDC может быть передана на другой контроллер домена, можно настроить групповую политику, которая будет автоматически применять настройки синхронизации с внешним NTP источников времени на текущем DC с ролью PDC.

Для этого в консоли управления Group Policy Management Console (
GPMC.msc
), создайте новый WMI фильтр групповых политик. Перейдите разделе WMI Filters, создайте фильтр с именем PDC Emulator и WMI запросом:

Select * from Win32_ComputerSystem where DomainRole = 5

Картинка с сайта: winitpro.ru

Создайте новую GPO, откройте ее и перейдите в раздел Computer Configuration-> Administrative Templates -> System -> Windows Time Service -> Time Providers

Нас интересуют три политики:

• Configure Windows NTP Client: Enabled (настройки политики описаны ниже)
• Enable Windows NTP Client: Enabled
• Enable Windows NTP Server: Enabled

В настройках политики Configure Windows NTP Client укажите следующие параметры:

• NtpServer: 0.ru.pool.ntp.org,0x8 1.ru.pool.ntp.org,0x8 2.ru.pool.ntp.org,0x8 3.ru.pool.ntp.org,0x8
• Type: NTP
• CrossSiteSyncFlags: 2
• ResolvePeerBackoffMinutes: 15
• Resolve Peer BAckoffMaxTimes: 7
• SpecilalPoolInterval: 1024
• EventLogFlags: 0

Картинка с сайта: winitpro.ru

Примените созданный ранее фильтр PDC Emulator к GPO.

Осталось прилинковать новую GPO на контейнер Domain Controllers.

Настройка синхронизации времени на клиентах домена

В домене нужно настраивать время только на контроллере домена с ролью PDC. Он должен синхронизировать время с внешним NTP. Специально какие-то отдельные политики или настройки для синхронизации времени на оставшихся DC или компьютерах делать не нужно (это может быть даже вредно). Синхронизация времени должна отлично работать согласно иерархии AD (NT5DS).

На оставшихся (дополнительных) контроллерах домена и остальных клиентах синхронизация времени должна выполняться согласно иерархии домена. Проверим это:
w32tm /query /configuration

Если все настроено правильно, в качестве типа источника времени в разделе
TimeProviders
должен быть задан NT5DS.

Настройки службы времени хранятся в ветке реестра
HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
.

Если это не так, можно сбросить настройки синхронизации времени на клиенте и принудительно указать, что нужно использовать схему синхронизации по-умолчанию (по доменной иерархии):

net stop w32time
w32tm.exe /unregister
w32tm.exe /register
net start w32time
w32tm /config /syncfromflags:DOMHIER /update
w32tm /resync

Проверьте что теперь в качестве источника времени на клиенте используется ближайший контроллер домена (LogonServer):

w32tm /query /source

Типовые ошибки синхронизации времени на клиентах Windows описаны в статье.

Ok

Time accuracy between workstations/member servers and domain controllers is a key requirement for the proper functioning of the Active Directory domain. In order for the time sync in AD o work properly in AD, the administrator needs to configure the PDC domain controller to synchronize its time with an authoritative NTP time source. The remaining DCs and the workstations will synchronize their time according to a domain hierarchy

In some cases, it may also be necessary for the administrator to configure the NTP time sync settings in the domain using Group Policies.

How Does Time Sync Works in an AD Domain?

In the AD environment, the time synchronization is performed according to a strict domain hierarchy:

• Workstations and member servers synchronize their time with the DCs that are closest to them;
• DCs synchronize their time with the single DC assigned the FSMO Primary Domain Controller Emulator (PDC) role;
• PDC domain controller is the main time source in the domain. PDC can synchronize its time with the local hardware (CMOS) clock (default) or with an external NTP source;
• The PDC emulators in the child domains synchronize their time with the DCs from the parent domain;
• The PDC emulator in the root domain is the main time source for the entire AD forest.

A typical hierarchy of time sources in an AD DS domain is shown in the following diagram:

Картинка с сайта: theitbros.com

Configure PDC to Sync Time with External NTP Time Source

According to Microsoft’s best practices, an administrator must enable the root PDC to sync its time with an external NTP time source.

Locate the domain controller with the PDC role in the forest root domain using the command:

netdom /query fsmo

Connect to the PDC and check the current time source:

w32tm /query /source

The following outputs are possible:

• Local CMOS Clock — means that the time source on this server is its local hardware clock (CMOS).
• VM IC Time Synchronization Provider — if a virtualized domain controller is used, it syncs its time with the hypervisor host.

Disable time sync with the local CMOS clock on the PDC:

Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider -Name Enabled -Value 0

Restart the W32Time service on PDC:

Restart-Service "Windows Time"

On virtualized domain computers, disable the time sync with the hypervisor in the VM properties.

• Hyper-V: disable the Time Synchronization option under Integration Services
• VMware ESXi: edit VM settings > VM Options > VMware Tools > Time, uncheck the option Synchronize guest time with host.

Картинка с сайта: theitbros.com

Obtain the names or IP addresses of the authoritative external time sources (NTP providers) to sync the time with. It is preferable to use public NTP servers from NTP Pool Project or your ISP’s NTP servers.

Go to https://www.ntppool.org, find your location and copy the name of the NTP server. In the case of the US, it can be 0.us.pool.ntp.org, 1.us.pool.ntp.org, etc.

Check if the selected external NTP server is accessible from the PDC (UDP port 123 is used for connection).

w32tm /stripchart /computer:0.us.pool.ntp.org

In this example, the specified NTP server is available and you have successfully obtained the current time from it.

Картинка с сайта: theitbros.com

Enable time synchronization on the PDC host with an external NTP source:

net stop w32time

w32tm /config /syncfromflags:manual /manualpeerlist:"1.us.pool.ntp.org,0x8 1.us.pool.ntp.org,0x8 2.us.pool.ntp.org,0x8 3.us.pool.ntp.org,0x8"

w32tm /config /reliable:yes

w32tm /config /update

net start w32time

Sync time with NTP server:

w32tm /resync

Check your current configuration:

w32tm /query /configuration

Картинка с сайта: theitbros.com

Note. The forest root domain PD emulator is the only host in Active Directory that should have NTP as its time provider.

Check the current NTP client settings:

w32tm /query /status

Run the command:

w32tm /monitor

This command displays the time differences between each DC and the external time source.

To reset other DCs in a domain to the default time sync scheme, use the command:

w32tm /config /syncfromflags:DOMHIER /update

Tip. If something does not work, try to restart the Windows Time service and reset its configuration:

net stop w32time

w32tm.exe /unregister

w32tm.exe /register

net stop w32tim

Configure External NTP Source on PDC with GPO

As the PDC emulator role can be transferred between DCs, you must ensure that the current PDC role holder syncs its time with the external NTP time source. This can be achieved by using the Group Policy which sets the external time source settings for the current PDC holder.

1. Open the Group Policy Management Console (GPMC.msc);
2. Select the WMI Filters section and create a new WMI filter with the name Filter PDC Emulator and the following WMI query in the root\CIMv2 namespace Select * from Win32_ComputerSystem where DomainRole = 5
   

   Картинка с сайта: theitbros.com

3. This WMI filter used to select the DC holding the PDC role.
4. Create a new GPO and link it to the AD OU named Domain Controllers;
5. Edit this GPO. Navigate to Computer Configuration > Administrative Templates > System > Windows Time Service
6. Enable the policy Global Configuration Settings and set AnnounceFlags to 8.
   

   Картинка с сайта: theitbros.com

This makes the domain controller a reliable time server in the forest.

1. Then expand the Time Providers section in the GPO editor.
2. Enable the following policy options:
   Configure Windows NTP Client: Enabled (policy settings are described below);
   Enable Windows NTP Client: Enabled;
   Enable Windows NTP Server: Enabled.
   

   Картинка с сайта: theitbros.com

3. Specify the following settings in Configure Windows NTP Client policy:
   NtpServer: us.pool.ntp.org,0x1 1.us.pool.ntp.org,0x1 2.us.pool.ntp.org,0x1 3.us.pool.ntp.org,0x1;
   Type: NTP;
   CrossSiteSyncFlags: 2;
   ResolvePeerBackoffMinutes: 15;
   Resolve Peer BAckoffMaxTimes: 7;
   SpecilalPoolInterval: 3600;
   EventLogFlags: 0.
   

   Картинка с сайта: theitbros.com

4. Assign the WMI filter “Filter PDC Emulator” that you created earlier to the GPO.
   

   Картинка с сайта: theitbros.com

5. Increase the priority of your GPO in the GPMC by moving it above the Default Domain Controller Policy in the link order list;
6. Configure your corporate Internet firewall to allow outbound NTP traffic (UDP port 123) from all the DCs to external time sources;

Note. Never set NT5DS as the server type in the GPO for the PDC emulator! Only NTP should be set here.

Configure Domain Client Time Sync Settings Using GPO

By default, domain computers synchronize their time with domain controllers according to the domain hierarchy (option Nt5DS). This time sync scheme works correctly in most cases and requires no further configuration. If you are experiencing problems with time sync on domain clients, you can try specifying the time server directly on clients using GPO.

1. Create a new GPO and assign it to the OU with computers;
2. Navigate to Computer Configuration > Administrative Templates > System > Windows Time Service > Time Providers and enable the policy Configure Windows NTP Client.
   

   Картинка с сайта: theitbros.com

3. Specify your domain name (preferred) or IP address/FQDN of the PDC as the NTP server

NTP Server: adatum.com,0x9
Set Type: NT5DS
CrossSiteSyncFlags: 2
ResolvePeerBackoffMinutes: 15
ResolvePeerBackoffMaxTimes: 7
SpecialPollInterval: 3600
EventLogFlags: 0

Note. The NT5DS value means that the client syncs its time according to the domain hierarchy (used by default on domain-joined computers);

Update Group Policy settings on the clients and check the received time sync settings as described above. By default, the domain clients synchronize their clocks once per hour (3,600 seconds).

1. If virtual machines are used as domain workstations or member servers, you should disable time synchronization with the hypervisor on them. This can be achieved by creating a special registry parameter using the GPO.
2. Navigate to Computer Configuration > Preferences > Windows Settings > Registry > New > Registry Item
3. Create a reg item with the following settings:
   Action: Update
   Hive: HKEY_LOCAL_MACHINE
   Key Path: SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider
   Value Name: Enabled
   Value Type: REG_DWORD
   Value Data: 0

Картинка с сайта: theitbros.com

In some cases, you can manually sync the client time with Domain Controller.

Time synchronization in an Active Directory is critical to properly functioning of the domain services and security mechanisms. If a proper and reliable time sync scheme is not configured in the domain, it can lead to problems with authentication, use of cryptographic protocols, and certificate validation when interacting with both internal and external systems. For example, Kerberos authentication requires that the time difference between the client and server be less than five minutes. In this guide, we’ll explore how time synchronization works in an Active Directory and how to configure a domain controller to sync its time with an external accurate NTP time source.

How Time Synchronization Works in an Active Directory Domain

The Active Directory time synchronization scheme is based on a strict domain hierarchy:

• The main time source in the AD is the domain controller with the PDC emulator FSMO role.
• Other domain controllers synchronize their time with the PDC.
• Member servers and workstations sync time with the nearest DC in accordance with AD topology ( by default, Windows computers synchronize their time with the external time source time.windows.com, but after joining a domain, time synchronization is performed according to the AD domain hierarchy).

Картинка с сайта: woshub.com

Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc773013(v=ws.10)?redirectedfrom=MSDN

To ensure accurate time on all domain computers, you must configure the PDC to synchronize its time with a reliable external time source using the NTP protocol.

To find out the name of the domain controller that is running the PDC Emulator FSMO role, run the PowerShell command

Get-ADDomain | Select-Object PDCEmulator

Manually Configure the PDC to Sync Time with External NTP Server

By default, the Primary Domain Controller (PDC) Emulator synchronizes time with the system’s local CMOS hardware clock on the host machine. Run the command on it to check:

w32tm /query /source

Local CMOS Clock indicates that the local clock is used as the time source. In this case, the Event Viewer log on the PDC contains the Event ID 12 from Time-Service:

Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.

Картинка с сайта: woshub.com

If the DC is running on a virtual machine that is configured to synchronize its time with the host (hypervisor), this command returns:

VM IC Time Synchronization Provider

Therefore, on all domain controllers, you should disable time sync in the virtual machine settings or prevent the DC from syncing time with the host by configuring the appropriate registry option:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\VMICTimeProvider /v Enabled /t REG_DWORD /d 0 /f

Let’s reconfigure the Windows Time settings on the PDC to use an external NTP server as the time source. As a time source, you can use the NTP server closest to your location from the https://www.ntppool.org project pool.

For the UK, this can be NTP servers from uk.pool.ntp.org: 0.uk.pool.ntp.org, 1.uk.pool.ntp.org, and 2.uk.pool.ntp.org

Make sure that these NTP servers are accessible from the PDC (and that port 123/UDP is not blocked by firewalls).

w32tm /stripchart /computer:1.uk.pool.ntp.org

Картинка с сайта: woshub.com

If you receive a response from the NTP server, you can use these external hosts as a time source for the Primary DC. Run the command:

net stop w32time
w32tm /config /syncfromflags:manual /manualpeerlist:"0.uk.pool.ntp.org,0x8 1.uk.pool.ntp.org,0x8 2.uk.pool.ntp.org,0x8"
w32tm /config /reliable:yes
net start w32time
w32tm /config /update

Sync the host time with NTP:

w32tm /resync

Check that the external NTP server time is now used as the time source on the PDC (check the TimeProviders section):

w32tm /query /configuration

Картинка с сайта: woshub.com

Configuring NTP Time Source for PDC with Group Policy

Because the PDC Emulator role can be transferred (seized) to another domain controller, you can configure a Group Policy that automatically applies external NTP synchronization settings to whichever DC currently holds the PDC role.

To do this, open the Group Policy Management Console (GPMC.msc) and create a new WMI Group Policy filter. Navigate to the WMI Filters section, create a filter named PDC Emulator with the WMI query:

Select * from Win32_ComputerSystem where DomainRole = 5

Картинка с сайта: woshub.com

Create a new GPO, open it, and go to the Computer Configuration-> Administrative Templates -> System -> Windows Time Service -> Time Providers

Configure the following three GPO options:

• Configure Windows NTP Client: Enabled (the policy settings are described below)
• Enable Windows NTP Client: Enabled
• Enable Windows NTP Server: Enabled

Set the following parameters in the Configure Windows NTP Client policy settings:

• NtpServer: 0.uk.pool.ntp.org,0x8 1.uk.pool.ntp.org,0x8 2.uk.pool.ntp.org,0x8 3.uk.pool.ntp.org,0x8
• Type: NTP
• CrossSiteSyncFlags: 2
• ResolvePeerBackoffMinutes: 15
• ResolvePeerBAckoffMaxTimes: 7
• SpecilalPoolInterval: 1024
• EventLogFlags: 0

Картинка с сайта: woshub.com

Assign the PDC Emulator filter you created earlier to the GPO.

Now link this GPO to the Domain Controllers organizational unit.

Time Sync Settings on Client Computers in AD

In a domain, you only have to manually configure time synchronization on the domain controller with the PDC role. It should sync time with external NTP. No special policies or settings are required for time synchronization on the remaining domain controllers or client computers (workstations). In fact, making such changes can be counterproductive. Time sync in the domain should work fine according to the AD hierarchy (NT5DS).

On the remaining (additional) domain controllers and other clients, time synchronization should be performed according to the domain hierarchy. Verify this:

w32tm /query /configuration

If the configuration is correct, the time source type in the TimeProviders section should be NT5DS (Net Time 5 Directory Service).

The time service settings on the client are stored in the HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters registry key.

If this is not the case, you can reset the client’s time synchronization settings and force it to use the default domain hierarchy time sync scheme

net stop w32time
w32tm.exe /unregister
w32tm.exe /register
net start w32time
w32tm /config /syncfromflags:DOMHIER /update
w32tm /resync

Verify that the closest domain controller (LogonServer) is now used as the time source on the client:

w32tm /query /source