I have two domain controllers, DC1 and DC2, with DC2 holding the PDC Emulator role. The PDC is configured to use pool.ntp.org, while domain-joined workstations are configured through Group Policy to use the domain hierarchy (NT5DS). I have run w32tm /config /syncfromflags:domhier /update, restarted the Windows Time service, and even unregistered and registered w32tm again. However, running w32tm /resync still returns: "The computer did not resync because no time data was available." UDP 123 traffic appears to work between the workstation and domain controller, but the Leap Indicator reports 3, meaning the system considers itself unsynchronized. What should I check next?
3 Answers
If the domain controllers are virtual machines, check the hypervisor immediately. VMware Tools or Hyper-V Integration Services can continuously synchronize the guest clock with the physical host, fighting Windows Time and leaving the guest with Leap Indicator 3. Disable host-to-guest time synchronization for the domain controllers, especially the PDC Emulator, and let w32time manage the clock instead.
Start with the PDC Emulator. Make sure it is configured with a manual peer list and marked as reliable, for example with /manualpeerlist:"pool.ntp.org,0x8" /syncfromflags:manual /reliable:yes /update. Then restart the time service and check its status with w32tm /query /status and w32tm /query /source. A PDC that has not been marked reliable may not advertise usable time to the rest of the domain.
The PDC shows a Leap Indicator of 0, and its client and server settings are enabled. I still need to verify that it is explicitly configured as reliable.
Also look for a conflicting Group Policy or DNS setting. Search the applicable policies for NTP, time service, manual peer lists, and configured time servers; an old policy can overwrite the settings you apply locally. Use w32tm /monitor to compare the controllers, and run dcdiag to confirm that the PDC is advertising correctly. If the PDC is too far out of sync with its upstream source, set it close to the correct time first, then retry discovery and resynchronization. Make sure the PDC can resolve and reach the selected NTP servers over UDP 123.
These are virtual machines, so the host time integration setting is definitely something I need to check. That may be overriding the Windows Time configuration.