Several machines in the domain are about two minutes ahead of the time shown on mobile phones. The physical domain controller holding the PDC Emulator role is reporting "Local CMOS Clock" as its time source. I'm considering configuring it to use an external source such as time.windows.com or an NTP pool. Is this a safe change on a production domain, and are there any precautions or domain-wide effects I should plan for?
4 Answers
Yes, a two-minute correction is generally safe and this is a normal configuration change. You can configure the PDC Emulator with one or more reliable external NTP peers, mark it as reliable, restart the Windows Time service, and then force a resynchronization. For example: `w32tm /config /manualpeerlist:"time.windows.com,0x8 pool.ntp.org,0x8" /syncfromflags:manual /reliable:yes /update`, followed by restarting `w32time` and running `w32tm /resync`. Make sure outbound NTP traffic over UDP 123 is allowed.
The change itself is low risk, especially with the clock only being off by a couple of minutes. I’d still perform it during a maintenance window and monitor the result with `w32tm /query /status` and `w32tm /query /source`. Avoid having virtualization hosts and guests form a time loop; the PDC should ultimately have one authoritative external source, while the rest of the domain follows the domain time hierarchy.
An external source is preferable to relying on the server’s local hardware clock. time.windows.com can work, but it may occasionally be inconsistent or ignore frequent requests. Using two or more dependable NTP sources, or an internal network time appliance if one is available, provides better resilience. A small correction should not cause a domain disaster, but large sudden jumps can affect Kerberos authentication, certificates, and encrypted connections, so check the time change afterward.
For a lasting setup, use Group Policy rather than configuring only the current PDC manually. Apply the external NTP settings to whichever domain controller currently holds the PDC Emulator role, using a WMI filter such as `SELECT * FROM Win32_ComputerSystem WHERE DomainRole = 5`. The other domain controllers and domain members should normally use the domain hierarchy, so they follow the PDC rather than all querying the Internet independently.
If you use this approach, also verify that the remaining domain controllers are configured for the domain hierarchy. Otherwise, a future PDC role transfer could leave multiple controllers using separate external sources.