Staff noticed that the clocks on several machines were about two minutes ahead of their phones. I found that the domain controller holding the PDC Emulator role was also about two minutes off, and `w32tm /query /source` reported `Local CMOS Clock`. The server is physical rather than virtual. I'm considering configuring it to use `time.windows.com` or another external NTP source. Is changing the time source on the PDC Emulator safe, and are there any precautions or domain-wide effects I should plan for?
4 Answers
`time.windows.com` can work, but it isn’t always the most consistent choice. Use a dependable NTP service or an internal network time appliance if you have one. The usual design is one authoritative external source for the PDC Emulator, with the remaining domain controllers and clients following the Active Directory time hierarchy.
A two-minute correction is generally safe and nowhere near the kind of time difference that causes major domain problems. You can configure the PDC Emulator with one or more reliable external peers, mark it as reliable, restart the Windows Time service, and force a resync. It’s still sensible to make the change during a maintenance window and verify synchronization afterward.
For a lasting configuration, use Group Policy rather than a one-time manual change. A WMI filter based on `DomainRole = 5` can target whichever domain controller currently holds the PDC Emulator role, so the setting follows the role if it moves. The other domain controllers should continue using the domain hierarchy instead of all independently querying external NTP servers.
That second part is important: if every DC is configured for external NTP, a future PDC role change can leave multiple independent time sources in the environment.
The change itself is low risk, but do it after hours if possible. Check the PDC’s sync status, confirm that the other domain controllers and clients converge on the correct time, and watch for certificate or authentication issues while the time adjustment propagates. A small two-minute correction should not normally cause trouble.
The PDC switching to Local CMOS after being promoted can be normal Windows behavior, but it should be configured with an authoritative external source in a domain environment.