[There's a reason that Yoda is the unofficial mascot of SBS. Size indeed matters not.] Need to set up the SBS box as an authoritative Time Server? - THE OFFICIAL BLOG OF THE SBS "DIVA"
Wed, Jan 3 2007 12:53 bradley

Need to set up the SBS box as an authoritative Time Server?

Somewhere I saw (and I can't remember where) that time.nist.gov has been deprecated and we shouldn't use it anymore to sync our domain controllers to.... and the time server we should be is point to Pool.ntp.org instead.  Make sure that the CEICW has poked open the port 123 UDP holes in the firewall (it does in ISA 2004 for example).

Net time is what we used to use, and now we use w32tm instead as net time is "deprecated" as they call it.

The commands to use at the server are basically as follows:

If you are time syncing with a Non Windows server you may have to do a 0x8 command shown below:

(edit) Keep in mind that this external time sync source is if you want to point your DC to an external time source, I've personally found that even without these commands, that the internal XP clients will pick up the time clock of the server without any w32tm commands, however if you are finding that the time syncing is not occuring, or you want to ensure that it's syncing and you want to point to an external clock, this is the commands to do so)

This problem may occur when your computer sends synchronization requests by
using symmetric active mode. By default, Windows Server 2003 domain
controllers are configured as time servers and use symmetric active mode to
send synchronization requests. Some NTP servers that do not run Windows
respond only to requests that use client mode.

To resolve this problem, configure Windows Time to use client mode when it
synchronizes with the time server. To do this, follow these steps:

1. Click Start, click Run, type cmd , and then press ENTER.  

2. At the command prompt, type the following commands in the order that
they are given. After you type each command, press ENTER.

w32tm /config /manualpeerlist: NTP_server_IP_Address ,0x8/syncfromflags:MANUAL  
net stop w32time  
net start w32time  
w32tm /resync  


For more info:
Time synchronization may not succeed when you try to synchronize with a
non-Windows NTP server in Windows Server 2003
http://support.microsoft.com/?id=875424  

The full info on the w32 commands are here: 

w32tm [/? | /register | /unregister ]
  ? - this help screen.
  register - register to run as a service and add default
    configuration to the registry.
  unregister - unregister service and remove all configuration
    information from the registry.

w32tm /monitor [/domain:<domain name>]
               [/computers:<name>[,<name>[,<name>...]]]
               [/threads:<num>]
  domain - specifies which domain to monitor. If no domain name
    is given, or neither the domain nor computers option is
    specified, the default domain is used. This option may be
    used more than once.
  computers - monitors the given list of computers. Computer
    names are separated by commas, with no spaces. If a name is
    prefixed with a '*', it is treated as a PDC. This option
    may be used more than once.
  threads - how many computers to analyze simultaneously. The
    default value is 3. Allowed range is 1-50.

w32tm /ntte <NT time epoch>
  Convert a NT system time, in (10^-7)s intervals from 0h 1-Jan 1601,
  into a readable format.

w32tm /ntpte <NTP time epoch>
  Convert an NTP time, in (2^-32)s intervals from 0h 1-Jan 1900, into
  a readable format.

w32tm /resync [/computer:<computer>] [/nowait] [/rediscover] [/soft]
  Tell a computer that it should resynchronize its clock as soon
  as possible, throwing out all accumulated error statistics.
  computer:<computer> - computer that should resync. If not
    specified, the local computer will resync.
  nowait - do not wait for the resync to occur;
    return immediately. Otherwise, wait for the resync to
    complete before returning.
  rediscover - redetect the network configuration and rediscover
    network sources, then resynchronize.
  soft - resync utilizing existing error statistics. Not useful,
    provided for compatibility.

w32tm /stripchart /computer:<target> [/period:<refresh>]
    [/dataonly] [/samples:<count>]
  Display a strip chart of the offset between this computer and
  another computer.
  computer:<target> - the computer to measure the offset against.
  period:<refresh> - the time between samples, in seconds. The
    default is 2s
  dataonly - display only the data, no graphics.
  samples:<count> - collect <count> samples, then stop. If not
    specified, samples will be collected until Ctrl-C is pressed.

w32tm /config [/computer:<target>] [/update]
    [/manualpeerlist:<peers>] [/syncfromflags:<source>]
    [/LocalClockDispersion:<seconds>]
    [/reliable:(YES|NO)]
    [/largephaseoffset:<milliseconds>]
  computer:<target> - adjusts the configuration of <target>. If not
    specified, the default is the local computer.
  update - notifies the time service that the configuration has
    changed, causing the changes to take effect.
  manualpeerlist:<peers> - sets the manual peer list to <peers>,
    which is a space-delimited list of DNS and/or IP addresses.
    When specifying multiple peers, this switch must be enclosed in
    quotes.
  syncfromflags:<source> - sets what sources the NTP client should
    sync from. <source> should be a comma separated list of
    these keywords (not case sensitive):
      MANUAL - include peers from the manual peer list
      DOMHIER - sync from a DC in the domain hierarchy
  LocalClockDispersion:<seconds> - configures the accuracy of the
    internal clock that w32time will assume when it can't acquire
    time from its configured sources.
  reliable:(YES|NO) - set whether this machine is a reliable time source.
    This setting is only meaningful on domain controllers.
      YES - this machine is a reliable time service
      NO - this machine is not a reliable time service
  largephaseoffset:<milliseconds> - sets the time difference between
    local and network time which w32time will consider a spike.

w32tm /tz
  Display the current time zone settings.

w32tm /dumpreg [/subkey:<key>] [/computer:<target>]
  Display the values associated with a given registry key.
  The default key is HKLM\System\CurrentControlSet\Services\W32Time
    (the root key for the time service).
  subkey:<key> - displays the values associated with subkey <key> of the default
 key.
  computer:<target> - queries registry settings for computer <target>

And keep this in mind if you are still having issues... 

Error message when you run the "w32tm /resync" command to synchronize Windows Server 2003 or Windows SBS to an external time source: "The computer did not resync because no time data was available":
http://support.microsoft.com/kb/929276/en-us

Filed under:

# re: Need to set up the SBS box as an authoritative Time Server?

Wednesday, January 03, 2007 9:12 PM by Nick

Kind of random... but I did a short write-up on the basics behind Windows time synchronization a while back... thought it might prove useful to link here...

http://addicted-to-it.blogspot.com/2006/01/kb-introduction-to-windows-time.html

# re: Need to set up the SBS box as an authoritative Time Server?

Wednesday, January 03, 2007 9:33 PM by Matt

You can condense that all down into a single command by adding /update at the end:

w32tm /config /manualpeerlist:ntp_servername /syncfromflags:MANUAL /update

No need to restart the service in XP or 2003 (or Vista).  Update will also force a sync.

# re: Need to set up the SBS box as an authoritative Time Server?

Wednesday, January 03, 2007 10:37 PM by BP

First, if the Windows 2003 SBS is acting as a client, I dont belive there is a need to open port 123 in any firewall. Certainly if you are providing sntp services outside the firewall, but otherwise no. Any comments?

Second, can anyone state with authority how a default SBS 2003 install is configured or if it is configured at all to sync time with any outside source? Is any of this necessary on a default install?

# re: Need to set up the SBS box as an authoritative Time Server?

Thursday, January 04, 2007 12:04 AM by Tim Long

That's all useful information. The Windows time service is great for general business use but as an astronomer I need a more accurate time reference for some of my applications. On my home/office SBS network I use a program called Tardis2000 on the server and a related program called K9 (which is a minimal client application) that runs on the workstations. Both applications run as services so they are fault tolerant and self-starting. Tardis2000 uses normal SNTP to set the time from the internet pool time servers. It adapts the interval with which it adjusts the time based on the size of adjustment made and it also attempts to trim the system clock speed so that fewer updates are necessary. Having set the server time accurately, Tardis2000 then re-broadcasts the time using broadcast-NTP on the internal network, about once a minute. The K9 client on the workstations listens for these NTP broadcasts and adjust their time accordingly. This keeps my entire network synchronised to itself and UTC with an accuracy of better than 100 milliseconds, which is fine for what I need.

# re: Need to set up the SBS box as an authoritative Time Server?

Thursday, January 04, 2007 6:58 AM by mark

Re: BP's post

The SBS box is a client of the external time server, but is also the authoritative time server in your windows domain, as is any forest root server in an AD by default. You only need to open the port if, as Susan suggests, you wish to allow the SBS box to get its time info from an external source.

On my network, my firewall has NTP server capability, so I just point my SBS box to get its time sync from there. The firewall syncs with pool.ntp.org. Therefore I don't have to allow the port 123 traffic

# re: Need to set up the SBS box as an authoritative Time Server?

Thursday, January 04, 2007 12:07 PM by BP

I dont need to open a port to get web pages or pop mail from an external source, why would I need to open a port to get the time?