Time synchronisation and multiple time sources/peers

hi, have hardware time source gets it's time 5 stratum 1 internet sources, plus couple of gps receivers within our environment. currently, have pdc emulator (windows 2008 r2) use ntp server as it's time source, , our domain heirarchy references pdce through 16 dcs (some 2003, 2008r2) in our single 2003 native mode ad, , 68 of our sites time through either dc, , have 5 timezones. added complexity have vmware on blade chassis blades time ntp hardware source, , esx hosts configured time hardware ntp system. non-windows systems time directly same hardware ntp source, including switches.

i configured pdc emulator instructions edit registry from http://<cite>support.microsoft.com/kb/816042</cite>

we having times there divergence happening dcs as 5 seconds out (from ntp source) , member servers have been as 130 seconds out (mostly in distant sites).

• is supported / best practice configuration have all our dcs time ntp server directly , not depend upon domain hierarchy depends upon pdce?
• additionally, member servers have dependency on accurate time (some of our applications, our database servers, sharepoint , other servers use kerberos authentication) - valid / best practice these servers configured time hardware ntp device too?
• finally, 1 ntp server in 1 site, appropriate way me specify pdce (whcih hardware standalone server , not esx or blade) is backup or secondary time source? should enter into "hklm\system\currentcontrolset\services\w32time\parameters\ntpserver" achieve this?

thanks feedback...

hi christian,

your summary represent best solution in circumstances.

to clear though, w32tm - ntp implementation, no better or worse hardware's (or software abstraction layer such hypervisor in between) timing ability. there's nothing wrong construct of service itself. said, fact checks every ten minutes strong mechanic.

in relation registry entry, setting ignored unless client flags set manual. make sure you use "win32tm /query /configuration" , "/query /peers" commands determine how service configured , synchronisation status of it's upstream ntp peers, not registry.

your comment boot stage local clock referenced before windows time service starts pain point , i've seen numerous kerberos , derived errors being different @ startup, there's no way resolve that. underlying hardware or virtualisation platform has on same time schedule , if there's "breaking point" somewhere between hypervisor or local clock , ntp source issue has resolved separately, outside of windows space.

there must reason such dramatic slide on such short period of time.

i've seen before on physical hardware frequency timing of particular model of server had wasn't spot on, hardware clock slipping against of ntp source, manifested in kerberos , swag of knock-on issues upon rebooting. corrected bios update particular generation of server.

the current place work @ small medium in size, yet our vsphere cluster of 120 virtual , around 2 dozen physical guests is configured described above , has no such discrepencies in time when compared upstream public stratum 1 servers.

these both meant serve anecdotal references, point windows time service quite robust , there other variables influence outcome. if problematic courtesy of design, wouldn't useful anyone.

cheers,
lain

Windows Server  >  Directory Services