Shulou(Shulou.com)06/02 Report--

Recently, it has been found that the company's server time has been inaccurate and cannot be synchronized with external time sources. The company is a domain environment, so the client PC should automatically synchronize with the domain control AD, but the PC time is always unable to synchronize, either slower or faster, or inconsistent with the domain control time. Other servers did not join the domain, but also hope to synchronize with AD time, but always have all kinds of problems, unable to synchronize, after a meal of Baidu Google finally solve the problem, now record the solution process.

Environment introduction:

Domain control AD: as a time server, it is provided as a time source for PC and other servers that join a domain or without a domain, and as a client of an Internet time server, time is automatically synchronized from the Internet time server.

Procedure:

1. Configure AD as NTPclient to synchronize time from the Internet time server

By default, the domain controller does not have the internet time configuration label in the time configuration, because the domain controller defaults to its own time and provides time to the PC or member servers that join the domain, that is, the domain member machine will treat the domain control as a time source server and synchronize automatically.

Here you need to modify the registry.

Open the registry and navigate to: HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ W32Time\ TimeProviders\ NtpClient branch and set the enable value to decimal 1, which means that ntp client is enabled.

Then set the value of SpecialPollInterval to 900, which indicates how long it takes to synchronize with the server, in seconds.

Then, under the config subitem, modify the announceFlags value to 5 in decimal.

AnnounceFlags is set to 5 to synchronize with external time sources, and 10 to native BIOS time.

Go to the Parameters branch and change the value of ntpserver to external time source domain name or ip address and type value to ntp.

This is also the time server of Aliyun found on the Internet, and the test is available. Ali provides seven time source servers, which are:

Time1.aliyun.com

Time2.aliyun.com

Time3.aliyun.com

Time4.aliyun.com

Time5.aliyun.com

Time7.aliyun.com

There can be multiple values for ntpserver, separated by spaces.

To this point, the ntp client configuration is complete

Open the command line (run as an administrator) to restart the w32time service, and the service should be set to start automatically.

Displays the external time source specified by the current server

W32tm / query / status can see the time summary of the last successful synchronization of the time source domain name and IP address.

Displays the time difference between the local time and the target time

W32tm / stripchart / computer:time7.aliyun.com / samples:30 / dataonly

It is basically accurate to see that the difference between the current time of the machine and the time source is very small.

two。 Configure AD or any machine to provide a time source internally by NTPserver

Open the registry and navigate to: HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ W32Time\ TimeProviders\ NtpServer branch and set the enable value to decimal 1, which means that ntp server is enabled.

3. Using domain policy to provide time source for PC

Open the domain policy manager, create a new gpo editor, navigate to computer configuration-Administrative templates-system-Windows time Service, double-click Global time configuration, and select enabled.

Modify the value of MaxNegPhaseCorrection to 900s, 15 minutes

Modify the value of MaxPosPhaseCorrection to 900s, 15 minutes

Modify the value of AnnounceFlags to 5

Click "apply" and "OK".

Computer configuration-Administrative templates-system-Windows time Service-time provider, enable Windows NTP client, select enabled.

Configure Windows NTP client, select enabled.

Change the value of NtpSever to ntpserver ip or domain name, 0x6

Change the Type value to NTP

Modify the value of SpecialPollInterval to 900 (15 minutes)

4. Time synchronization configuration of pc and other servers that are not added to the domain

5. common problem

If you are synchronizing manually, synchronization errors may often occur.

The cause of the error may be that the w32time service is not started, it is best to set it to start automatically and restart the service if necessary.

There is a delay in foreign time source networks, so try to use domestic sources.

Another important reason is that the improper application of group policy can also cause the problem of unsynchronized.

This is the case I encountered. At first, I applied the synchronization time policy to the entire forest, including domain controllers and member servers. In this way, not only the time of the domain control server is not accurate, but also lead to PC and other times are not accurate, and manual synchronization will make errors.

The solution is:

Apply the policy to the OU that does not contain a domain control server.

The above is the whole content of this article, I hope it will be helpful to your study, and I also hope that you will support it.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.