Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
contact@evotec.pl

Synchronizing Active Directory with External Time Source

Synchronizing Active Directory with External Time Source
Active Directory
0
By Przemyslaw Klys Active Directory PowerShell January 24, 2018

One of the crucial parts in modern IT world is proper time and date. While it may seem that 30 seconds or even 5 minutes is not a big deal it actually matters. Modern certificates, systems and many security features require proper time verification. In Active Directory based environment all computers, servers are by default to sync time from main domain controller. While this is great it also means main domain controller actually has to to have proper time. And this is where you need to make sure it's always up to date. Solution to this is synchronizing active directory with external time source.

Solution

To make sure your Primary Domain Controller (PDC) is always up to date when it comes to time you have to:

Find your PDC (I assume you know one, but just in case…) 

[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().RootDomain.PdcRoleOwner.Name

Find out your current configuration

# Get current time settings
w32tm /query /status

Change your time settings to multiple trusted NTP servers:

# Set time settings 
w32tm.exe /config /manualpeerlist:"0.europe.pool.ntp.org 1.europe.pool.ntp.org 2.europe.pool.ntp.org 3.europe.pool.ntp.org" /syncfromflags:manual /reliable:YES /update

# Update configuration
w32tm.exe /config /update

# Restart Time service
Restart-Service w32time

Verify if the settings were updated properly. If the answer is incorrect try multiple times. It may take a moment or two to process things.

# Get current time settings
w32tm /query /status

Finally confirm output

PS C:\Windows\system32> w32tm /query /status
Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0418354s
Root Dispersion: 7.8054506s
ReferenceId: 0x8AC9876C (source IP:  138.201.135.108)
Last Successful Sync Time: 1/24/2018 5:10:56 PM
Source: 2.europe.pool.ntp.org 
Poll Interval: 6 (64s)

If you're located elsewhere it's quite easy to find multiple other NTP sources such as US based: “0.us.pool.ntp.org 1.us.pool.ntp.org 2.us.pool.ntp.org 3.us.pool.ntp.org”

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Related Posts

Mastering Active Directory Hygiene: Automating Stale Computer Cleanup with CleanupMonster
Have you ever looked at your Active Directory and wondered, “Why do I still have computers listed that haven’t been turned on since World Cup 2016?” Yeah, we’ve all been there. Keeping AD clean and up-to-date is like trying to organize your garage—it’s easy to put off until it becomes a total mess.
25 Aug 2024
Renaming NETBIOS name of Active Directory Error
Recently I was testing renaming the NETBIOS name of an Active Directory domain. While this process is fairly easy, there are a few gotcha’s, and before one would like to rename their domain or NETBIOS name, serious testing is required to be sure everything works after rename. In the end, if something goes wrong, the rollback will not be a walk in a park. It will hurt, and it will eat your time. So there was I going thru the usual steps.
16 Feb 2020
Install-Module : A parameter cannot be found that matches parameter name AllowPrerelease.
22 Aug 2018
Reporting group membership for critical Active Directory groups
I work a lot with Active Directory-related tasks. One of the tasks is to know the group membership of critical Active Directory Groups such as Domain Admins, Enterprise Admins, Schema Admins, Event Log Readers, and a few others that are a bit less known. As I did it, I got bored of typing the group names repeatedly and decided that enough was enough and there must be an easier way for me to do that.
07 Aug 2022
Office 365 – Limiting license to minimum apps required
Office 365 has a lot of options and applications to choose from. Enabling one E1, E3, or any other license gives the user a lot of features, including Exchange, SharePoint, and Teams. But what if you want to make sure that the user can access only Microsoft Teams? By default, you can do it manually during the assignment of the license. Simply choose only Apps you want to assign to a user.
07 Apr 2020
Function cannot be created because function capacity 4096 has been exceeded for this scope
Function cannot be created because function capacity 4096 has been exceeded for this scope
I had a long day today when my long-running script (10 hours) gave me weird errors with Microsoft Graph for Teams. Finally, I solved my mistakes and reran the hand to see if the report would be complete this time. Surprisingly, it gave me an error I’d never seen before. “Function cannot be created because function capacity 4096 has been exceeded for this scope”. The error is at least weird because it’s shown on a production server where I’ve just a handful of PowerShell modules installed, and I’ve never seen it on my development machine where I’ve over 200 modules.
01 Aug 2023
LAPS and Bitlocker
Backing up Bitlocker Keys and LAPS passwords from Active Directory
Having a modern, secure infrastructure in 2019 is a requirement. You should implement BitLocker to make sure that in the event of stolen laptop data is not readily extractable and implementing LAPS is a must in a fast changing IT world. But I’m not here to convince you to those two security features. I’m here to show you an easy way to backup LAPS and BitLocker. While having everything stored in Active Directory is excellent, things can get complicated when you don’t have access to your Active Directory, or you restore an older version of it. You see, LAPS, for example, keeps only last Administrator password. This is great and all but what happens if you restore the machine from backup from 6 months back? Your password has already changed multiple times. During our testing of DR scenarios, we wanted to access the computer via their local Administrator credentials and we just couldn’t because that password was already gone.
31 Mar 2019
Server Types
How to find different server types in Active Directory with PowerShell
Working as a freelancer is a great thing if you can handle it. Each day, each week something new happens and a new problem shows up on my doorstep. It also means it’s almost never boring at your job and you get to play with new stuff. But there’s one drawback to this. You’re often thrown at the problem, told to fix it but often that’s about as much information as you get. It wasn’t very different today. I was told to switch Office 365 from ADFS to Password Synchronization. While reasons for this are not really important, the important question here is what is the name of AD Connect server that’s responsible for this configuration?
06 Feb 2019
Compare PowerShell
PowerShell – Comparing advanced objects
Two years ago, I wrote a blog post on how you can compare two or more objects visually in PowerShell that works on Windows, Linux, or macOS. I’ve been using that for a while, but it had a specific flaw. Comparing more advanced objects that you often see (for example, returned by Graph API, two config files) wasn’t working correctly, often throwing errors. The reason for this was that having nested hashtables arrays require more advanced logic. Today I’ve updated my module to use the ConvertTo-FlatObject function, which allows the Compare-MultipleObjects function to compare suitably more advanced objects hopefully. Of course, it should not throw errors anymore.
28 Feb 2022
Office 365 User Script
Office 365 – Report containing User Information and Mailbox Usage
Working with Office 365 is my bread and butter in the last few months. I’m a System Architect and I am dropped in multiple projects, both new and old, to fix certain aspect and get out before anyone sees me. One of the common tasks I get is to provide some data about users stored in Office 365.
29 Jan 2019
Active Directory DHCP Report to HTML or EMAIL with zero HTML knowledge
I’m pretty addicted to reading blog posts. I saw this new blog post the other day, where the author created the DHCP HTML report, and he did it by manually building headers, footers, table borders, and finally, adding some coloring to the percentage of DHCP being in use. It’s the “standard” approach to build HTML in PowerShell, and I’ve seen a similar path before, but that got me thinking how much time it would take for me to replicate the very same functionality using PSWriteHTML module.
12 Jul 2020
Track Ubiquiti Unifi Stock, and get notified of changes
I am a pretty big fan of Ubiquiti and their Unifi products line. Whether it’s network equipment or their camera systems, Unifi Protect, I have it all, and I’m pretty happy with how it works. However, over the last two years, some of their stocks in the store were very hard to find. For example, I’ve searched for Unifi Protect G4 Doorbell Pro for over six months. I’ve tried local shops all around Europe, even in the Ubiquiti Europe store, to never found any of them.
16 Apr 2023
MicrosoftE xchange
Microsoft Exchange – Set Address Book Policy to multiple users based on group membership
0
28 Jan 2016
AccountLockout
Active Directory – How to track down why and where the user account was locked out
I’ve been working with Windows Events for a while now. One of the things I did to help me diagnose problems and reporting on Windows Events was to write PSEventViewer to help to parse the logs and write PSWinReporting to help monitor (with use of PSEventViewer) Domain Controllers for events that happen across the domain. It’s handy and I, get those excellent daily reports of what happened while I was gone.
24 Jan 2019
Format-Table
Does having Format-Table or Format-List in the middle of the pipeline makes sense?
Recently there was this discussion on PowerShell Group on Facebook about issue posted by one user. While the subject doesn’t matter for this post, few people commented on the idea that he was using Format-Table in the middle of the pipeline to do something. They all said Format-Table should be used as last in the pipeline. Otherwise, you would get the wrong output. But should it? Well, it depends!
24 Apr 2019

Leave a comment

You must be logged in to post a comment.