ntpwindows-server-2012-r2
I need to build an NTP server within my network on Windows Server 2012. This server must be dedicated only for NTP. I am using the W32tm service to configure my NTP to resynchronise its time from "Time.windows.com"..
The configuration is perfect, but how can I break hierarchy of time within network?
Usually clients take their time from the Domain controller. I need to make all clients resynchronise their time from my NTP server instead.
Jeff, I found this article. Might be of some help to you. You might have already read this but I thought it was worth a shot.
HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlagsThis registry entry controls whether the local computer is marked as a reliable time server (which is only possible if the previous registry entry is set to NTP as described above). Change this REG_DWORD value from 10 to 5 here.
UPDATE As per Jeff, best source of reference is http://support.microsoft.com/kb/816042
There is a built-in hierarchy for this already, and you shouldn't change it. The computers will find a domain controller nearest to them for time synchronization based on the site and subnet information defined in Sites and Services. Those domain controllers in turn will synchronize their time with the domain controller that holds the PDC emulator FSMO role. That domain controller holding the role should be configured to use NTP time synchronization against a reliable source be it internal or external, and all the rest of the domain members should fall in line. Typically people will sync against NIST, Microsoft, Apple, or pool.ntp.org. It's also pretty common to have your core switch/router do this and then point all devices needing time sync to that.
EDIT
Here is a couple articles referring to doing just this:
http://technet.microsoft.com/en-us/library/cc786897(v=ws.10).aspx
Here's the command to run on your DC that is the PDC emulator:
w32tm /config /manualpeerlist: peers /syncfromflags:manual /reliable:yes /update
All you need to do here is configure and sync that PDC emulator DC and everything else joined to AD will start to synchronize and you can call it a day. Attached the image below for your reference (it's in one of the links above). It's also worth noting that this takes care of your Microsoft systems just fine, but if say you had Linux servers or networking devices needing NTP protocol responses you may run into compatibility issue since Microsoft's implementation as an NTP server is shall we say... not so great. Like I mentioned above I will typically point my core router at an external time source, and then point the PDC emulator at that. Everything else in my network needing NTP gets pointed to their local router which is in turn pointed to my core router.
Best Answer
It's actually more important, in terms of the domain continuing to work properly, that your clients and member servers use Domain Controllers for their time source than it is that your clients have the correct time. I know this sounds odd, but it's true. Clients on a domain need their clocks to be similar within a certain degree of accuracy in order for clients and servers to trust one another for authentication, etc.
Therefore, my suggestion is that you leave the clients and member servers syncing time with the domain, and configure the DC holding the PDC emulator role to be the one that uses the external time source.
There's a possibility here to save the licence you're using for the dedicated ntp server and have the PDC emulator sync directly to time.windows.com itself, by the way. The "local dedicated ntp server" scenario is more common when your local ntp server is a stratum 1 time server connecting directly to a reference clock - for example I use two of these.
Anyway, to configure any system to use an external time source, try something like the w32tm.exe command:
To force a manual update from your newly configured time source, to check it's working and make the initial changeover:
Restart the time service for the change to take effect:
From the command line / batch script:
Or if you've been using the powershell environment: