Domain time issue, server to clients

domaintimewindows-server-2012

I have a server 2012 running as the DC also running DHCP. I have three PCs on this domain right now and all three get the incorrect time.

The server has the proper time set and the proper time zone and displays it correctly in the lower right of the taskbar. However even after I manually correct the time on the clients they immediately go back two hours. the time zone on the clients are set correctly, daylight savings time I do have checked for all the clients and the server because naturally I do want it to do that.

I can't figure this one out. I have even tried adding a time and NTP server as my server and even tried one of the government NTP servers as well. Adding these to my DHCP scope of course. None of these tries helped correct the issue.

Best Answer

I would not use DHCP to configure time sources for Active Directory domain members.

Member servers and workstations should be synchronizing time from a domain controller, not an external time source:

Configure a client computer for automatic domain time synchronization
http://technet.microsoft.com/en-us/library/8990703a-a197-4717-b6e5-b7406d9f91f0 

w32tm /config /syncfromflags:domhier /update 
net stop w32time & net start w32time

That configuration can be specified in Group Policy.

To display the status of the time service: 

w32tm /query /status /verbose

Your DC also needs to be advertising as a time server. To display the time server advertising status on your DC: 

C:\ nltest /server:win2008r2addc1 /dsgetdc:contoso.com

           DC: \\WIN2008R2ADDC1.contoso.com
      Address: \\192.168.135.133
     Dom Guid: 0db7aee9-a93c-4f26-bed6-ee9894886573
     Dom Name: contoso.com
  Forest Name: contoso.com
 Dc Site Name: Default-First-Site-Name
Our Site Name: Default-First-Site-Name
        Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS

Note the TIMESERV flag, that indicates your DC is advertising as a time server. If it is the forest root PDC Emulator role, it will also have the GTIMESERV flag. The forest root PDC Emulator is the only computer that should synchronize with an external time source.

An example of how to configure the forest root PDC emulator with the NIST NTP source: 

 w32tm /config /manualpeerlist:time.nist.gov /syncfromflags:manual /reliable:yes /update

Configure the Windows Time service on the PDC emulator in the Forest Root Domain
http://technet.microsoft.com/en-us/library/ce8890cf-ef46-4931-8e4a-2fc5b4ddb047

Windows Time Service Group Policy Settings
http://technet.microsoft.com/en-us/library/cc773263%28v=ws.10%29.aspx#w2k3tr_times_tools_vwtt

Related Topic