How does time sync work on a Windows Domain? (2024)

How does the time sync on a Windows Domain and why is it important?

Time synchronization within a Windows domain is crucial for various reasons, including: authentication, event correlation, and accurate logging as well as a proper logon token issuance for user logon sessions.

This synchronization ensures that all machines within the domain have reasonably accurate time, reducing authentication issues and ensuring consistency in event logging and security-related processes.

In a Windows domain environment, time synchronization occurs through a hierarchical model called the Windows Time service (W32Time), which relies on the following components:

1. Primary Domain Controller (PDC) Emulator: In an Active Directory domain, the PDC Emulator role holder is the primary source for time synchronization. The PDC Emulator maintains the authoritative time for the domain.
2. Hierarchy and Time Propagation: The PDC Emulator synchronizes with an external time source, such as a reliable internet time server or a hardware-based time source. Other domain controllers and member machines synchronize their time with the PDC Emulator.
3. Windows Time Service (W32Time): This service manages time synchronization within the domain. It uses the Network Time Protocol (NTP) to synchronize time between the PDC Emulator and other domain machines.
4. Group Policy Settings: Group Policy Objects (GPOs) can be used to configure time synchronization settings for domain-joined machines. This includes specifying the source for time synchronization and setting intervals for synchronization checks. This setting is not present by Default, so I would recommend that you create it manually.
5. Windows Time Hierarchy: The Windows Time service follows a hierarchy within the domain to maintain time synchronization. Domain controllers synchronize with the PDC Emulator, and member machines synchronize with their authenticating domain controller.

The time synchronization hierarchy on a Windows domain works as follows:

• The PDC Emulator retrieves time from an external time source, such as a stratum 2 time server, AKA the atomic clock.
• Domain controllers synchronize their time with the PDC Emulator Domain Controller Role holder.
• Member machines and clients synchronize their time with their authenticating domain controller.

Some symptoms of time synchronization problems within a Windows domain include:

1. Authentication Failures: Inconsistent time across domain controllers and systems can cause authentication failures, preventing users from logging in or accessing network resources.
2. Event Log Discrepancies: Timestamps in event logs may appear incorrect or inconsistent, making it challenging to correlate events accurately for troubleshooting and security analysis.
3. Kerberos Authentication Failures: Kerberos, the authentication protocol used in Active Directory environments, heavily relies on time synchronization. Mismatched time can cause Kerberos authentication failures and prevent users from accessing resources.
4. Replication Issues: Time differences between domain controllers can lead to replication problems within the Active Directory environment. Inconsistent or delayed replication affects the consistency of directory data across the domain.
5. Certificate Errors: SSL/TLS certificates on servers or services may fail to validate due to time differences, leading to SSL handshake errors or invalid certificate warnings in applications or browsers.

On a Windows Workstation or a server the W32TM setting can be viewed in the registry. Open command prompt as administrator and type regedit

Then browse to this location

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\Parameters

On a Domain joined workstation and any domain joined Server OS you should see NT5DS like this

Type value means the protocol being used which is NT5DS – Windows domain hierarchical time sync protocol.

On a PDC emulator Domain Controller the setting would look like this:

The protocol being used is NTP which means the PDC emulator Domain Controller role holder is synchronizing time with time.nist.gov which is the NTP protocol time server.

How to test NTP time sync on the PDC emulator

You can run w32tm /query /status in CMD to determine if the PDC is properly syncing time to the stratum 2 server and what the NTP time source is.

C:\>w32tm /query /status

Leap Indicator: 0(no warning)

Stratum: 2 (secondary reference - syncd by (S)NTP)

Precision: -6 (15.625ms per tick)

Root Delay: 0.0514553s

Root Dispersion: 0.0409130s

ReferenceId: 0x808A8DAC (source IP: 128.138.141.172)

Last Successful Sync Time: 11/29/2023 8:25:52 AM

Poll Interval: 9 (512s)

Typical Domain Time synchronization errors you may see:

"The trust relationship between this workstation and the primary domain failed"

“there is a time and/or date difference between the client and server”

“An Active Directory Domain Controller for the Domain Could Not Be Contacted”

Do you have time sync issues on your Windows Domain? We can help!