Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
contact@evotec.pl

Synchronizing Active Directory with External Time Source

Synchronizing Active Directory with External Time Source
Active Directory
0
By Przemyslaw Klys Active Directory PowerShell January 24, 2018

One of the crucial parts in modern IT world is proper time and date. While it may seem that 30 seconds or even 5 minutes is not a big deal it actually matters. Modern certificates, systems and many security features require proper time verification. In Active Directory based environment all computers, servers are by default to sync time from main domain controller. While this is great it also means main domain controller actually has to to have proper time. And this is where you need to make sure it's always up to date. Solution to this is synchronizing active directory with external time source.

Solution

To make sure your Primary Domain Controller (PDC) is always up to date when it comes to time you have to:

Find your PDC (I assume you know one, but just in case…) 

[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().RootDomain.PdcRoleOwner.Name

Find out your current configuration

# Get current time settings
w32tm /query /status

Change your time settings to multiple trusted NTP servers:

# Set time settings 
w32tm.exe /config /manualpeerlist:"0.europe.pool.ntp.org 1.europe.pool.ntp.org 2.europe.pool.ntp.org 3.europe.pool.ntp.org" /syncfromflags:manual /reliable:YES /update

# Update configuration
w32tm.exe /config /update

# Restart Time service
Restart-Service w32time

Verify if the settings were updated properly. If the answer is incorrect try multiple times. It may take a moment or two to process things.

# Get current time settings
w32tm /query /status

Finally confirm output

PS C:\Windows\system32> w32tm /query /status
Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0418354s
Root Dispersion: 7.8054506s
ReferenceId: 0x8AC9876C (source IP:  138.201.135.108)
Last Successful Sync Time: 1/24/2018 5:10:56 PM
Source: 2.europe.pool.ntp.org 
Poll Interval: 6 (64s)

If you're located elsewhere it's quite easy to find multiple other NTP sources such as US based: “0.us.pool.ntp.org 1.us.pool.ntp.org 2.us.pool.ntp.org 3.us.pool.ntp.org”

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Related Posts

PSWriteHTML creating Email Body
Easy way to send emails using Microsoft Graph API (Office 365) with PowerShell
When you’re using Office 365 and want to send an email, you have two choices SMTP or Microsoft Graph API, which is a “new” kid on the block. For some time, I’ve used Microsoft Graph exclusively to send emails in favor of SMTP as it’s much easier to manage and generally works over HTTPS. If you type in google “Send email graph API PowerShell,” you will get lots of hits as bloggers, and Microsoft has already covered this topic. It’s even more critical than ever because Basic Authentication is deprecated in Office 365. To help out with the transition, Microsoft even released its PowerShell module. With Send-MgUserMail proposed as a way to send emails via Graph API, you will notice it’s far from being easy & user-friendly. Over two years ago, I released a PowerShell module called Mailozaurr (some people may not like my modules’ naming – but that’s how I roll!). In a blog post, Mailozaurr – New mail toolkit (SMTP, IMAP, POP3) with support for oAuth 2.0 and GraphApi for PowerShell, I’ve shown a basic functionality on how to send emails using SMTP OAuth 2.0 or Graph API, which aims to be drag & drop replacement over Send-MailMessage and is supposed to be as simple as possible to send an email with a low effort and high readability. You can also read on sending emails using Graph API by Tony Redmond in his blog post Moving on from Send-MailMessage: Sending Email from PowerShell using the Graph API.
09 Oct 2022
PowerShell
Get-AdPermission – The operation couldn’t be performed because object couldn’t be found
0
25 Feb 2016
Microsoft Graph – InvalidAuthenticationToken – Access token validation failure. Invalid audience
Today I had a need to connect to Microsoft Graph and do some tasks on Office 365. Since I have already done similar stuff for my PSwinDocumentation.O365HealthService PowerShell module that I’ve described in PowerShell to get all information about Office 365 Service Health, I thought this will be easy run as I’ll just reuse the code I’ve done for that module. As always for Graph related tasks you need to register your application and assign correct permissions. I’ve used my own article for that with changes to which API I want to access. Now that I’ve done all that I’ve extracted my Connect-O365Graph function from my module and started connecting.
05 Dec 2019
Active Directory
Delegating Active Directory attribute physicalDeliveryOfficeName
0
17 Aug 2016
AzureAD – Enable Password Expiration with Password Hash Synchronization
Azure AD Connect allows three ways to make sure the user password is the same in Active Directory and Office 365. Those are Password Hash Sync, Pass-Thru Authentication, and ADFS. While my preferred option to go with would be Pass-Thru Authentication, only Password Hash Synchronization is the easiest and least resource-intensive. It synchronizes user password to Office 365, and even if your Active Directory is down, you can still log in to Office 365. It’s perfect for small and even more significant companies that don’t have resources or can’t guarantee that their infrastructure will stay 100% time online so users can authenticate based on their Active Directory.
24 Feb 2020
Visually display Active Directory Trusts using PowerShell
Active Directory Trusts are useful to connect one or more domains. But as useful those are, they can be very dangerous. Also, keeping trusts working and in good shape should be a top priority for Active Directory Admins. While there is a couple of command in the Active Directory module Get-ADTrust, I thought I would try and write my own that checks a few more things. I want to thank Chris Dent for his input on the part of this command. His binary skills amaze me!
14 Sep 2020
Dashimo Conditional Formatting
Dashimo – Easy Table Conditional Formatting and more
Dashimo ultimate goal is to be as easy to use as possible. With the introduction of it a few days ago I made a promise to myself that I want to keep it as simple to use as possible. If you don’t know what Dashimo is, have a read here – Meet Dashimo. When I posted it on Reddit few people had some ideas and feature request that would make it a bit nicer, and when I heard about I agreed. So today, after a couple of days I have a few updates. I also noticed that my examples might have been too hard to use and understand for beginners and people not having a lot of touch with Active Directory. This time all code you can find below will use Get-Process as a way to show you that you can use any output that comes as a Table.
04 Apr 2019
Function cannot be created because function capacity 4096 has been exceeded for this scope
Function cannot be created because function capacity 4096 has been exceeded for this scope
I had a long day today when my long-running script (10 hours) gave me weird errors with Microsoft Graph for Teams. Finally, I solved my mistakes and reran the hand to see if the report would be complete this time. Surprisingly, it gave me an error I’d never seen before. “Function cannot be created because function capacity 4096 has been exceeded for this scope”. The error is at least weird because it’s shown on a production server where I’ve just a handful of PowerShell modules installed, and I’ve never seen it on my development machine where I’ve over 200 modules.
01 Aug 2023
O365Synchronizer Image
Syncing Global Address List (GAL) to personal contacts and between Office 365 tenants with PowerShell
Hey there! Today, I wanted to introduce you to one of the small but excellent module I’ve created called the O365Synchronizer. This module focuses on synchronizing contacts and users. If you’ve ever been tasked with synchronizing Global Address Lists (GAL) across different Office 365 tenants or just wanted to sync GAL with user mailboxes so they can access contacts directly on their phones, this tool is for you.
03 Dec 2023
PSWinReporting Legacy Edition
PSWinReporting 1.8 – Split of branches (Legacy vs. New Hope)
A new branch of PSWinReporting is slowly coming, and I thought it would be the best time to have a final article about it with all configuration options available for those that will want to stay using PSWinReporting from Legacy branch. The idea is that you may have it working in your systems and it’s good enough for you. You may not want to change it, and with New Hope, the changes are so big it’s a rewrite.
10 Mar 2019
Office 365 Org Settings
Configuring Office 365 settings using PowerShell – The non-supported way
Office 365 is a huge beast. It has so many services that it’s hard to track all of them. It’s even harder if you want to manage Office 365 using PowerShell. Microsoft makes many different PowerShell modules available for you, such as AzureAD, AzureADPreview, ExchangeOnline, MicrosoftTeams, and recently, Microsoft.Graph. But even with so many different modules, there are still tasks that Microsoft won’t let you do from PowerShell. But it doesn’t mean that it’s not possible to do it. I’ve spent some time tracking how Microsoft does things while you click thru the interface and created an O365Essentials PowerShell module that can do it in an automated way.
26 Sep 2021
ConvertTo-FlatObject
PowerShell – Converting advanced object to flat object
PowerShell language allows you to work and build complicated objects. There are multiple ways to save them, such as XML or JSON, but sometimes using them is impossible or inadequate. Sometimes you want to use HTML or CSV or any other single dimension output.
27 Feb 2022
Expired password RDP
How to change your own expired password when you can’t login to RDP
I must admit that it was a bit embarrassing to see my Administrator password expired when I tried to log in as Domain Admin to Domain Controller. I got this little message saying This user account’s password has expired. The password must change to logon. Please update the password or contact your system administrator or technical support.
23 Jan 2019
Microsoft Graph API Connect-MGGraph Error
Connect-MgGraph: Keyset does not exist
I had this little issue today when I tried to schedule the Microsoft Graph script to run as a service account on a certificate. To my surprise, even tho I had all permissions required, I was getting this error message: Connect-MgGraph: Keyset does not exist. Something that didn’t show up for my user.
20 Jul 2023
Powerful hashtables
How I didn’t know how powerful and fast hashtables are
I’ve been using PowerShell for a long while now using Hashtables, OrderedDictionary, and other types of data types in PowerShell, but I never paid attention to how powerful those are. And I don’t mean your general knowledge about hashtables that is already covered by Kevin Marquette in his article Everything you wanted to know about Hashtables or my article PowerShell – Few tricks about HashTables and Arrays I wish I knew when I started. Let’s find out, how Powerful they are, shall we?
19 May 2019

Leave a comment

You must be logged in to post a comment.