Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows 2003
    - Admin Tips
      - Active Directory
        A Quick Tip To Configure Time Service In Active Directory Environment

Section(s): Active Directory , Active Directory , Active Directory, Active Directory
Published on Mar 24, 2009.
Last Modified on Nov 28, 2008.
Last Modified by Nirmal Sharma.
Rated 3.7 out of 5 based on 3 votes.

This article explains how you can configure time service for an active directory environment.

Windows Time is necessary for domain controllers and client computers. This is a requirement for the Kerberos protocol for authentication purpose. You should keep the following points in mind when configuring the Windows Time Service in an Active Directory environment:

Configure your client computers to sync time from it's authentication or local domain controller in the site
Configure your DC to sync time from it's PDC Emulator for that domain
Configure your Child PDC to sync time from any DC in the Forest Root domain
Configure your Forest PDC to sync time from an external source (time.windows.com)

For the above things to work, you need to modify two registry entries:

For all Domain Controllers and PDC in the Forest except PDC in the Forest:

Key: HKLM\System\CurrentControlSet\Services\W32Time\Parameters
Entry: Type
Value: NT5DS

For Forest PDC:

Key: HKLM\System\CurrentControlSet\Services\W32Time\Parameters
Entry: Type
Value: NTP
Entry: NTPServer
Value: time.windows.com

About Nirmal Sharma

Nirmal is a Microsoft MVP in Directory Services and working as a Technical Architect/Consultant. He has been involved in Microsoft Technologies since 1994 and followed the progression of Microsoft Operating Systems and software. He is specialized in Directory Services, Microsoft Clustering, SQL, MOM, Exchange and Citrix. In his spare time, he likes to help others and write "internal" technical articles, white papers and tips on various Microsoft technologies. You can contact him at nirmal_sharma@mvps.org.