I have two domain controllers, DC1 and DC2. DC2 holds the PDC Emulator role and is configured to use pool.ntp.org as its external NTP source. A device policy configures domain-joined workstations to use the domain hierarchy with NT5DS.
I have already run w32tm /config /syncfromflags:domhier /update, restarted the Windows Time service, and even unregistered and registered w32time again. However, every attempt to run w32tm /resync fails with "The computer did not resync because no time data was available."
I confirmed that UDP port 123 traffic is passing between the workstations and domain controllers. The PDC shows a Leap Indicator of 0, but the affected systems show 3, meaning they consider themselves unsynchronized. What should I check in the domain time hierarchy or configuration?
5 Answers
Start by checking whether an old or incorrect GPO is configuring a named time server. Search your domain policies for settings containing terms like “NTP,” “Time,” or “Windows Time,” since a stale manual peer can override the domain hierarchy or point clients at a server that no longer resolves.
If the domain controllers are virtual machines, check the hypervisor settings. VMware Tools or guest integration services can continuously copy time from the physical host to a DC, fighting with w32time and leaving the system at Leap Indicator 3. Disable host-to-guest time synchronization for the domain controllers, especially the PDC Emulator, then configure the PDC as reliable and restart or resynchronize the service.
Run w32tm /monitor and inspect the current source and status across the hierarchy. If the PDC is too far out of sync with its external source, set its clock close to the correct time first and then run a rediscover or resync. Also confirm that the PDC can resolve and reach the selected NTP pool and that no firewall or routing rule is blocking UDP 123.
Verify that the PDC Emulator is advertising itself correctly. Use dcdiag to confirm it is advertising, check connectivity with w32tm /monitor, and make sure the PDC is configured as a reliable source with w32tm /config /reliable:yes /update. The PDC should use a manual external peer, while other domain controllers and clients normally follow the domain hierarchy with NT5DS.
The PDC has a Leap Indicator of 0, and the client and server settings appear enabled. I still need to confirm there are no conflicting policies on the other domain controllers.
Make sure the PDC is explicitly configured with the intended manual peer and appropriate flags, for example a regional pool such as us.pool.ntp.org,0x8, followed by /reliable:yes /update. Avoid mixing manual NTP settings on ordinary domain clients with NT5DS unless there is a specific reason; they should normally obtain time through the domain hierarchy.
This sounds like the most likely explanation. The domain controllers are virtualized, so host time synchronization may be overriding the Windows Time configuration.