Before changing the Windows Time Service configuration, confirm that the server holds the PDC Emulator FSMO role in the forest root domain. Configuring another domain controller does not place it at the top of the forest time hierarchy and can result in more than one server being treated as authoritative.

In a single-domain forest, the domain PDC Emulator is also the forest root PDC Emulator. In a multi-domain forest, each domain has a PDC Emulator, but only the role holder in the forest root domain should normally use an external NTP source.

Confirm the PDC Emulator role holder

The current PDC Emulator can be identified from an elevated Command Prompt with:

netdom query fsmo

PowerShell can also be used:

Get-ADDomain | Select-Object PDCEmulator

In a multi-domain forest, run the PowerShell command against the forest root domain rather than assuming that the PDC Emulator in the current domain is the authoritative server for the whole forest.

Choose suitable time sources

The PDC Emulator should use a reliable source that is reachable at all times. Suitable sources include an organisation's own NTP appliance, an internal GPS-backed server or established public NTP services.

More than one peer should normally be configured so that the loss of a single service does not leave the server without an external source. The peers should not all depend on the same underlying server or network where an alternative is available.

For a UK-based system, the NTP Pool Project can be used with names such as 0.uk.pool.ntp.org, 1.uk.pool.ntp.org, 2.uk.pool.ntp.org and 3.uk.pool.ntp.org. An organisation with its own approved time source should use that instead.

Windows Time Service uses UDP port 123 for NTP. Name resolution and outbound access to the selected peers must therefore be available from the PDC Emulator.

Configure the Windows Time Service

Open an elevated Command Prompt on the forest root PDC Emulator and run:

w32tm /config /manualpeerlist:"0.uk.pool.ntp.org,0x8 1.uk.pool.ntp.org,0x8 2.uk.pool.ntp.org,0x8 3.uk.pool.ntp.org,0x8" /syncfromflags:manual /reliable:yes /update

The command makes four changes:

  • /manualpeerlist defines the external NTP peers.
  • The 0x8 flag tells Windows Time Service to contact each peer using NTP client mode.
  • /syncfromflags:manual tells the server to use the manual peer list rather than the domain hierarchy.
  • /reliable:yes marks the domain controller as a reliable time source for systems below it in the hierarchy.

The /update option instructs Windows Time Service to apply the changed configuration.

The peer list must be enclosed in quotation marks when more than one server is specified. Peers are separated by spaces, while the flag is appended to each server name with a comma.

Restart and request synchronisation

The updated configuration will often be recognised immediately. Restarting the Windows Time Service provides a clear point from which to test the new settings:

net stop w32time
net start w32time

The equivalent PowerShell command is:

Restart-Service W32Time

Once the service has started, request a synchronisation:

w32tm /resync

A successful command confirms that the request was accepted, but it does not by itself prove that the intended peer supplied the time. The source and status should still be checked.

Verify the result

Display the currently selected source:

w32tm /query /source

Display the current synchronisation status:

w32tm /query /status

Display the effective Windows Time Service configuration:

w32tm /query /configuration

The source should be one of the configured peers rather than Local CMOS Clock, Free-running System Clock or another domain controller. The configuration output should show the manual peer list and an NTP synchronisation type.

The first synchronisation may not occur instantly. If the source remains incorrect, check name resolution, UDP port 123, the Windows Time event log and whether a Group Policy setting is overwriting the local configuration.

Further checks are covered in Verifying the Windows Time configuration.

When the PDC Emulator role moves

The external time configuration belongs with the FSMO role, not permanently with a particular server. When the PDC Emulator role is transferred or seized, the Windows Time configuration must be reviewed as part of the role move.

Configure the new forest root PDC Emulator with the approved external peers and mark it as reliable. The previous role holder should then be returned to domain hierarchy synchronisation:

w32tm /config /syncfromflags:domhier /reliable:no /update
net stop w32time
net start w32time
w32tm /resync

After the change, verify the source on both servers. The new role holder should use an external peer, while the previous role holder should obtain time through the domain hierarchy.

Common configuration mistakes

Most PDC Emulator time problems are caused by a small number of configuration errors:

  • Configuring the PDC Emulator in a child domain instead of the forest root domain.
  • Applying the external peer list to every domain controller.
  • Leaving the previous PDC Emulator configured as a reliable manual time source after an FSMO transfer.
  • Using peer names that the server cannot resolve.
  • Blocking outbound UDP port 123.
  • Omitting the client-mode flag when communicating with an NTP service that does not accept symmetric active requests.
  • Allowing Group Policy to overwrite settings applied locally with w32tm.

The configuration should be kept simple. One authoritative server uses the approved external peers, and every other domain system follows the Active Directory hierarchy.

Related information