This article shows how to configure Windows Time Service (NTP) on Windows Server 2016 to act as an NTP server for domain client computers.
Configure Windows Time Service (NTP)
A prerequisite to having the correct time on the Windows clients is the correct time on the Windows 2016 server. So the first step is to sync server time with pool.ntp.org. Type the following commands on PowerShell:
w32tm /config /manualpeerlist:pool.ntp.org /syncfromflags:MANUAL
Then apply the changes, this is done by restarting the time service. First, we stop the service and then we start it again.
Stop-Service w32time
Start-Service w32time
Now the Windows Server 2016 is an NTP client of pool.ntp.org and its time/clock is synced with the NTP pool servers (The server is at the same time the NTP server for other domain client systems).
Optional: Server is in a Hyper-V VM
If your Windows Server 2016 machine is a VM inside Hyper-V, you have to disable time sync. Go to:
M settings-> Management-> Integration Services
and uncheck:
Time Synchronization.
Otherwise, Windows Server 2016 time/clock will be synced with the Host time/clock.
Configure Windows Clients
Then go to the client machines and run the following command on PowerShell to force them to sync their time/clock with the domain controller on the Windows Server 2016.
w32tm /resync
You can check the time synchronization status using the following command.
w32tm /query /status
Frequently Asked Questions
What is NTP and why is it important in Windows Server 2016?
Network Time Protocol (NTP) is a protocol used to synchronize the clocks of computers to some time reference. In Windows Server 2016, it’s essential for ensuring that all devices in a network are synchronized, which is crucial for security, log management, and the proper functioning of time-sensitive processes.
How do I configure my Windows Server 2016 to act as an NTP server?
To configure your Windows Server 2016 as an NTP server, you need to edit the Windows registry. Start by opening regedit and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer. Set the Enabled flag to 1. This will enable the NTP Server feature on your server.
How do I set the time source for my NTP server?
Use the command prompt or PowerShell. The command is:
w32tm /config /syncfromflags:manual /manualpeerlist:"[peers]"
Where [peers] is a space-separated list of IP addresses or DNS names of the NTP servers you wish to synchronize with.
After configuring the NTP server, how do I ensure it’s working correctly?
You can check the status of your NTP server by using the command:
w32tm /query /status
in the command prompt. This will give you information about the NTP configuration and its current status.
How do I configure a Windows Server 2016 machine to use my NTP server?
On each client machine, run:
w32tm /config /syncfromflags:manual /manualpeerlist:"[server]" /reliable:YES /update
Replace [server] with the hostname or IP address of your NTP server, and then restart the Windows Time service.
Are there any security considerations when setting up an NTP server?
Yes, it’s important to ensure that your NTP server is only accessible by the intended clients to prevent misuse. Configure appropriate firewall settings to allow NTP traffic (port 123 UDP) only from trusted networks or machines.
Can I use an external NTP source for my Windows Server 2016?
You can configure your server to synchronize with external NTP servers, such as those provided by national time services or large internet service providers. This is done using the same w32tm /config command with the /manualpeerlist parameter.
How do I deal with time zone differences in NTP?
NTP itself deals only with UTC (Coordinated Universal Time). Time zone differences are handled at the client level, not by the NTP protocol. Ensure your server and client machines are configured with the correct local time zone.
What if I encounter errors when trying to synchronize time?
Common issues include network problems, incorrect firewall settings, or misconfigurations in the registry settings. Check the event viewer for specific error messages and verify that your server can reach the NTP peers.
How often does Windows Server 2016 synchronize time with the NTP server?
By default, Windows synchronizes time every 7 days (604800 seconds), but this interval can be modified in the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient\SpecialPollInterval.
These FAQs provide a basic guide to setting up and managing an NTP server in Windows Server 2016. Refer to the official Microsoft documentation or consult a network administrator for more detailed information.
In this article, I will show you how to configure NTP Server on Windows Server 2016 in just a few steps.
We will use PowerShell to change the NTP Server and we will validate if it worked afterward.
Configure the NTP Server on Windows Server 2016
On your Windows Server, 2016 hit the Windows Button and type: PowerShell and right-click it and select Run as Administrator
Type the following commands
w32tm /config /manualpeerlist:pool.ntp.org /syncfromflags:MANUAL Stop-Service w32time Start-Service w32time
Of course, you can take any NTP Server that you want.
Now verify if the time-server was set correctly on your Server 2016 by typing:
w32tm /query /status
You should get a reply like this:
Now we will go ahead and verify if our clients sync properly.
Verifying if the Time Server was correctly set on our Clients
On a client computer open a PowerShell with right-click and Run as Administrator….
Type:
w32tm /query /status
Check the time-server and type:
w32tm /resync w32tm /query /status
Then you are able to see that the time-server actually changed like in the example below.
And that’s it! Easy, right?
Always make sure that you use the same time-server in your network and that all your clients are syncing with it. If you have time differences inside of your Active Directory Domain you will run into major issues.
Home » OS’s » Windows » Set NTP Server Windows 2016 or Windows 2019
There is no question about it, having accurate time in your environment set in critical infrastructure systems is a must. Many business-critical applications and infrastructure systems rely on accurate time synchronized between them to ensure the system functions as expected. Time skew can cause all kinds of weirdness when it is misconfigured or out of sync between different servers/systems. This is especially true in a Windows Server Active Directory domain. Having accurate time between a client computer and domain controllers is essential. Let’s take a look at how to set ntp server Windows 2016 or Windows 2019 to see how this can be easily carried out.
What is NTP?
Wen it comes to synchronizing time in most enviornments, Network Time Protocol (NTP) is the protocol that is used to ensure accurate time across your environent. In most environments, NTP servers, special time servers, are configured that provide an external time source for which your internal servers can synchronize with.
There are several widely known NTP IP addresses on the Internet that provide reliable time sources for your network. The NTP.org servers are one such set of time servers that provide an NTP source for configuration.
There are a few NTP values to be aware of:
- NTP Server – This is a specialized server that is able to detremine the precise time from an external timing reference such as GPS and passes these precise time values on to your network
- Offset – This is the difference in time between the external time server and the time on a local client computer. The larger the offset, the more inaccurate the timing source is.
- Delay – This is the value of the round-trip time (latency) of the timing message between the client to the server and back again.
How Time is synchronized in a Windows Server domain
In a Windows domain, Microsoft has default configuration in place that takes care of a good portion of the NTP configuration. Starting with Windows 2000 Server, Windows clients are configured as NTP Clients. When configured as an NTP client, Windows computers only attempt to contact the domain controller for NTP synchronization or a manually specified NTP server.
Microsoft has made the domain controller the default in a Windows domain since it makes sense that clients already have a secure channel established with DCs for other types of communications. Additionally, accurate and synchronized time between domain controllers and clients is especially important for all kinds of things such as logins, group policy synchronization and other tasks/operations.
The order of operations or hierarchy in a Windows domain is as follows:
- Domain members attempt to synchronize time with any domain controller located in the domain
- Domain controllers synchronize with a more authoritative domain controller
- The first domain controller that is installed in the environment is automatically configured to be a reliable time source.
- Other than the first domain controller installed, the PDC emulator (if role has been moved from the first DC installed) generally holds the position of best time source.
An important point to consider and that comes into play when thinking about why we set ntp server in Windows 2016 or Windows 2019 is the authoritative domain controller must have a reliable source to synchronize with as well. This is generally an external time server outside of the domain hierarchy.
Now that we know how the domain hierarchy for time is configured, how is the external time source configured on your domain controller that is configured as the reliable source of time?
Configuring Windows Time Service with W32tm.exe
When it comes to Windows Server environments like Windows Server 2016 or Windows Server 2019, there is a special Windows service that controls the time synchronization of your Windows hosts. This is the Windows Time Service.
Microsoft provides a command line tool to interact with the Windows Time Service called W32tm.exe. This has been included in Windows operating systems since Windows XP/Windows 2003 and later. It can be used to configure Windows Time service parameters as well as diagnose time service problems. This is generally the tool of choice when it comes to configuring, monitoring, and administering Windows Time.
Using the W32tm.exe utility is fairly straightforward. It can be used from a normal command prompt as well as from a PowerShell prompt. There are several command parameters included that allow not only configuring the NTP servers you want to query, but also parameters that allow viewing the low level registry configuration as well as the synchronization status.
You can read the official Microsoft KB on the Windows Time service and the W32tm.exe utility here:
- https://docs.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings
However, there are a few commands I would like to show you for the purposes of configuring your Domain controller that is to be the reliable time source (PDC Emulator) for your domain.
The first command is the command line entry to specify your NTP servers, which in this case I am using the NTP.org servers to set as the source of my NTP synchronization.
w32tm /config /syncfromflags:manual /manualpeerlist:"0.us.pool.ntp.org 1.us.pool.ntp.org 2.us.pool.ntp.org 3.us.pool.ntp.org" /update Stop-Service w32time Start-Service w32time
If you want to view the status of the NTP synchronization on your server after you have configured the values and restarted the w32time service, you can use the following command:
w32tm /query /status
You can also check the values configured in your registry key hkey local machine system currentcontrolset services w32time config using the commands below. You can drill into the configuration parameters using the /dumpreg /subkey command.
w32tm /dumpreg w32tm /dumpreg /subkey:parameters
Final Thoughts
As shown, you can easily set NTP Server Windows 2016 or Windows 2019 using the w32tm command utility that allows interacting with the time service in Windows Server.
In a Windows domain, you want to configure your authoritative time source domain controller, which by default is the PDC Emulator, to pull time information from an authoritative source like NTP.org or some other reliable NTP time server.
After configuring the time source, the other domain controllers will synchronize with this server and then the Windows clients joined to the domain will synchronize with the domain controllers that have the corrected time from the authoritative server.
Brandon Lee is the Senior Writer, Engineer and owner at Virtualizationhowto.com, and a 7-time VMware vExpert, with over two decades of experience in Information Technology. Having worked for numerous Fortune 500 companies as well as in various industries, He has extensive experience in various IT segments and is a strong advocate for open source technologies. Brandon holds many industry certifications, loves the outdoors and spending time with family. Also, he goes through the effort of testing and troubleshooting issues, so you don’t have to.
NtpServer value must be time.google.com,0x9 or time.windows.com,0x9 or any other external NTP
Time Provider
Type value should be
NTP as because PDC will Act as NTP for all other ADC and workstation in Domain
Setting
Number 3
NtpClient>Enable
value must be 1 as it will act as client for external NTP Server
Setting
Number 4
NtpServer>Enable
value must be 1 as it will act as NTP server for Members servers
Run this command to resync the time
net stop w32time && net start w32time
w32tm /resync
w32tm /query /status
Additional Domain Controller NTP Configuration Setting
Below is the Registry Path for Time Setting in Registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
Setting
Number 1
Set AnnounceFlags
value 10 Decimal
Setting
Number 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
Set Type Value to
NT5DS so this will sync time from PDC
Setting
Number 3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
Set Enabled value 1
so this will sync time from NTP
Setting
Number 4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer
NtpServer>Enable
value must be 1 as it will act as NTP server for Members systems and server
Configuration Setting on Member Systems and
Workstation
Setting
Number 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags
value must be 10
Setting
Number 2 Default setting
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type
value must be NT5DS so it will take time from any member DC.
Watch Below video on NTP Configuration on Server 2016
Commands to troubleshoot in case of issue
1.
Command to check Time Status and
Source
a.
Command: w32tm /query /source
Output:
time.google.com,0x9
b. Command: w32tm /query /status
Leap
Indicator: 0(no warning)
Stratum:
2 (secondary reference — syncd by (S)NTP)
Precision:
-6 (15.625ms per tick)
Root
Delay: 0.1094525s
Root
Dispersion: 0.0265089s
ReferenceId:
0xD8EF230C (source IP: 216.239.35.12)
Last
Successful Sync Time: 12/2/2018 11:33:35 AM
Source:
time.google.com,0x9
Poll
Interval: 10 (1024s)
2.
Command to resync time with NTP
a. Command: w32tm /resync
Output:
Sending resync command to local computer
The
command completed successfully.
b. Command: C:\WINDOWS\system32>net
stop w32time && net start w32time
Output:
The
Windows Time service is stopping.
The
Windows Time service was stopped successfully.
The
Windows Time service is starting.
The
Windows Time service was started successfully.
c. Command: w32tm /resync /force
Sending
resync command to local computer
The
command completed successfully.
d. Command: w32tm /resync /rediscover
Sending
resync command to local computer
The
command completed successfully.
How to sync the time to a public time server using NTP
You need to use the w32tm command.
First check the current settings :
What about the 0x1 parameter ?
https://support.microsoft.com/en-us/help/875424/time-synchronization-may-not-succeed-when-you-try-to-synchronize-with
- 0x01 – Use special poll interval Special Interval
- 0x02 – Use As Fall back Only
- 0x04 – Send request as Symmetric Active mode
- 0x08 – Send request as Client mode
To set a new External Time Server like pool.ntp.org use this command :
net stop w32time w32tm /config /manualpeerlist:pool.ntp.org /syncfromflags:MANUAL net start w32time w32tm /resync
This is the configuration :
w32tm /query /configuration
These are all the command line switches :
w32tm [/? | /register | /unregister ]
? – this help screen.
register – register to run as a service and add default
configuration to the registry.
unregister – unregister service and remove all configuration
information from the registry.
w32tm /monitor [/domain:<domain name>]
[/computers:<name>[,<name>[,<name>…]]]
[/threads:<num>] [/ipprotocol:<4|6>] [/nowarn]
domain – specifies which domain to monitor. If no domain name
is given, or neither the domain nor computers option is
specified, the default domain is used. This option may be
used more than once.
computers – monitors the given list of computers. Computer
names are separated by commas, with no spaces. If a name is
prefixed with a ‘*’, it is treated as an AD PDC. This option
may be used more than once.
threads – how many computers to analyze simultaneously. The
default value is 3. Allowed range is 1-50.
ipprotocol – specify the IP protocol to use. The default is
to use whatever is available.
nowarn – skip warning message.
w32tm /ntte <NT time epoch>
Convert a NT system time, in (10^-7)s intervals from 0h 1-Jan 1601,
into a readable format.
w32tm /ntpte <NTP time epoch>
Convert an NTP time, in (2^-32)s intervals from 0h 1-Jan 1900, into
a readable format.
w32tm /resync [/computer:<computer>] [/nowait] [/rediscover] [/soft]
Tell a computer that it should resynchronize its clock as soon
as possible, throwing out all accumulated error statistics.
computer:<computer> – computer that should resync. If not
specified, the local computer will resync.
nowait – do not wait for the resync to occur;
return immediately. Otherwise, wait for the resync to
complete before returning.
rediscover – redetect the network configuration and rediscover
network sources, then resynchronize.
soft – resync utilizing existing error statistics. Not useful,
provided for compatibility.
w32tm /stripchart /computer:<target> [/period:<refresh>]
[/dataonly] [/samples:<count>] [/packetinfo] [/ipprotocol:<4|6>]
Display a strip chart of the offset between this computer and
another computer.
computer:<target> – the computer to measure the offset against.
period:<refresh> – the time between samples, in seconds. The
default is 2s
dataonly – display only the data, no graphics.
samples:<count> – collect <count> samples, then stop. If not
specified, samples will be collected until Ctrl-C is pressed.
packetinfo – print out NTP packet response message.
ipprotocol – specify the IP protocol to use. The default is
to use whatever is available.
w32tm /config [/computer:<target>] [/update]
[/manualpeerlist:<peers>] [/syncfromflags:<source>]
[/LocalClockDispersion:<seconds>]
[/reliable:(YES|NO)]
[/largephaseoffset:<milliseconds>]
computer:<target> – adjusts the configuration of <target>. If not
specified, the default is the local computer.
update – notifies the time service that the configuration has
changed, causing the changes to take effect.
manualpeerlist:<peers> – sets the manual peer list to <peers>,
which is a space-delimited list of DNS and/or IP addresses.
When specifying multiple peers, this switch must be enclosed in
quotes.
syncfromflags:<source> – sets what sources the NTP client should
sync from. <source> should be a comma separated list of
these keywords (not case sensitive):
MANUAL – sync from peers in the manual peer list
DOMHIER – sync from an AD DC in the domain hierarchy
NO – sync from none
ALL – sync from both manual and domain peers
LocalClockDispersion:<seconds> – configures the accuracy of the
internal clock that w32time will assume when it can’t acquire
time from its configured sources.
reliable:(YES|NO) – set whether this machine is a reliable time source.
This setting is only meaningful on domain controllers.
YES – this machine is a reliable time service
NO – this machine is not a reliable time service
largephaseoffset:<milliseconds> – sets the time difference between
local and network time which w32time will consider a spike.
w32tm /tz
Display the current time zone settings.
w32tm /dumpreg [/subkey:<key>] [/computer:<target>]
Display the values associated with a given registry key.
The default key is HKLM\System\CurrentControlSet\Services\W32Time
(the root key for the time service).
subkey:<key> – displays the values associated with subkey <key>
of the default key.
computer:<target> – queries registry settings for computer <target>.
w32tm /query [/computer:<target>]
{/source | /configuration | /peers | /status}
[/verbose]
Display a computer’s windows time service information.
computer:<target> – query the information of <target>. If not
specified, the default is the local computer.
source: display the time source.
configuration: display the configuration of run-time and where
the setting comes from. In verbose mode, display the undefined
or unused setting too.
peers: display a list of peers and their status.
status: display windows time service status.
verbose: set the verbose mode to display more information.
w32tm /debug {/disable | {/enable /file:<name> /size:<bytes> /entries:<value>
[/truncate]}}
Enable or disable local computer windows time service private log.
disable: disable the private log.
enable: enable the private log.
file:<name> – specify the absolute filename.
size:<bytes> – specify the maximum size for circular logging.
entries:<value> – contains a list of flags, specified by number and
separated by commas, that specify the types of information that
should be logged. Valid numbers are 0 to 300. A range of numbers
is valid, in addition to single numbers, such as 0-100,103,106.
Value 0-300 is for logging all information.
truncate: truncate the file if it exists.
Now that you set the server to properly sync you can use this one as internal NTP server for other devices.
TIP :
Keep in mind to set the firewall UDP 123 rules to accept.
More info see here
Enjoy !
This entry was posted on Wednesday, October 30th, 2019 at 4:18 pm and is filed under Server, Windows. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.