Setup a Active Directory Domain Controller as a NTP Server

Quite often, one can see errors in the NTP client like W32Time event 29.
A good way to solve this kind of issues is setting up a Domain Controller as NTP Server for the whole Active Directory.

For this, one should follow these steps.

1. Choose the Domain Controller to become the NTP Server. If you have older clients (Windows 2000) it should hold the PDC Emulator Role.

2. Open the Registry Editor(regedit) of the selected Domain Controller.

3. Find the Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeParametersType and modify the value to NTP to set the server has a NTP Server.

4. Make the server announce it self on Active Directory by changing the registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeConfigAnnounceFlags to 5.

5. Activate the NTP Server by changing the registry key

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeTimeProvidersNtpServerEnabled to 1.

6.  Now let’s set up the upstream NTP Server from where we will keep the time updated. To do so change the registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeParametersNtpServer to the appropriate public NTP Server(s). You can find your local public NTP Server at pool.ntp.org. Don’t forget to add “,0x1” after every server and separate server with a space.

7. Now let’s set the time update interval. Find the registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeTimeProvidersNtpClientSpecialPollInterval and set it to a reasonable value. For instance 15 minutes. Notice that the time is set in seconds, therefore, 15 minutes is 900 seconds.

8. Finally, let’s configure the time correction definitions. Edit the registry keys:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeConfigMaxPosPhaseCorrection and

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeConfigMaxNegPhaseCorrection. These keys should be set to a value, again in seconds. A reasonable value should be 3600 seconds, corresponding to 1 hour.
9. Close the registry editor and restart the Time Service by runnin g the command net stop w32time && net start w32time.
That’s it. Now you have a time server for the whole Active Directory domain.

Leave a Reply

Your email address will not be published. Required fields are marked *