NTP Server Configuration

Always make backups where applicable.
Always verify instructions fit your need.

Primary Domain Controllers:

Create a WMI filter to only apply the GPO to the PDC.

NOTE: As the PDC role can be transferred between domain controllers these settings are filtered to apply only to the current PDC.

Run the Group Policy Management Console (GPMC.msc)
Select the WMI Filters section and create a new WMI filter with name Only PDC
Use the following WMI query:
1. For name space >>> root\CIMv2
2. For Query >>> Select * from Win32_ComputerSystem where DomainRole = 5

Create/Configure a new GPO.
1. Create a new GPO at the top of the domain and name it "C - PDC External NTP Sync"
2. At the bottom of the GPO change WMI Filtering to: Only PDC
3. Right Click > Edit
4. Follow the steps below to do the following:
  1. Allow inbound NTP requests
  2. Configure NTP Settings
  3. Disable VM - Host time sync
  4. Set w32time to always start
5. Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall… > … > Inbound Rules
  1. Right Click > New Rule
  2. Port
  3. UDP: 123
  4. Allow the connection
  5. All (Domain, Private, and Public)
  6. Name: NTP_Server_123UDP
  7. Description: Allow Inbound Connections to NTP Server
6. Computer Configuration > Policies > Administrative Templates > System > Windows Time Service > Time Providers.
  1. Configure Windows NTP Client: Enabled
    1. NtpServer: 0.us.pool.ntp.org,0x8 1.us.pool.ntp.org,0x8 2.us.pool.ntp.org,0x8 3.us.pool.ntp.org,0x8
    2. Type: NTP
    3. CrossSiteSyncFlags: 2
    4. ResolvePeerBackoffMinutes: 15
    5. Resolve Peer BAckoffMaxTimes: 7
    6. SpecilalPoolInterval: 3600
    7. EventLogFlags: 0
  2. Enable Windows NTP Client: Enabled
  3. Enable Windows NTP Server: Enabled
7. Computer Configuration > Preferences > Windows Settings > Registry
  1. Right Click > New > Registry Item
    1. Hive: HKEY_LOCAL_MACHINE
    2. Key Path: SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\VMICTimeProvider
    3. Value: Enabled
    4. Value type: REG_DWORD
    5. Value data: 00000000
    6. Base: Hexadecimal
  2. NOTE: This is done to disable time synchronization between Virtual Machine and Host Machine when applicable.
8. Computer Configuration > Preferences > Control Panel Settings > Services
  1. Right Click > New > Service
    1. Startup: Automatic
    2. Service Name: w32time

Verify the settings are applied to the PDC
1. gpupdate /force
2. Via CMD as Admin
  1. w32tm /query /configuration
  2. The servers configurated above should be listed after: "[TimeProviders] > NTPClient (Local) > NtpServer "
3. To verify the time is correct or in the process of synchronizing, via CMD:
  1. W32tm /query /stripchart:0.us.pool.ntp.org
4. Check Windows Advanced Firewall to see if the Inbound rule is listed.

Verify NTP connection is possible
1. From another computer or server:
2. w32tm /stripchart /computer:<PDC FQDN>

NON-DOMAIN Windows devices to sync from DC

net stop w32time
w32tm /config /syncfromflags:manual /manualpeerlist:"<<PDC Hostname or IP>>,0x8 0.us.pool.ntp.org,0x2"
net start w32time
w32tm /config /update
W32tm /resync /force /nowait

Other Servers

Create a WMI filter to only apply the GPO to the Other Server.
1. Run the Group Policy Management Console (GPMC.msc)
2. Select the WMI Filters section and create a new WMI filter with name "Only <Server>"
3. Use the following WMI query:
  1. For name space >>> root\CIMv2
  2. For Query >>> Select * FROM Win32_ComputerSystem WHERE Name LIKE "SERVER-02" <Replace SERVER-02 with the name of the server>
Follow all of the above instructions making the following changes:
1. Set the WMI filter to Only <Server>
2. Set the name of the GPO to "C - <Server> External NTP Sync"
Verify NTP connection is possible
1. From another computer or server:
2. w32tm /stripchart /computer:<Server IP>
3. # Do not use the hostname as DNS servers may not have it registered properly or at all if it is not domain joined.
For other devices connecting to this server, set the NTP server to the server IP

Non Domain Servers

Open the LOCAL Group Policy Editor Console for the server:
1. Follow instructions 5 & 6 under "Primary Domain Controllers > Create/Configure a New GPO"
  1. Use local Group Policy editor.

1. Open Registry Editor as admin.
  1. Navigate to the key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\VMICTimeProvider
    1. If the Entry "Enabled" exists, set it to "0" (zero)
    2. If it does not exist, create a new "DWORD"
      1. Value Name: Enabled
      2. Value data: "0" (zero)
  2. Close the Registry Editor window.

1. Open Services.msc
  1. Right Click the service "Windows Time" and click properties
    1. Verify the service name is W32Time
      1. Set startup type: Automatic
    2. Recovery Tab:
      1. Set all options to: Restart the Service
      2. OK
    3. Close the services window.

Verify NTP connection is possible
1. From another computer or server:
2. w32tm /stripchart /computer:<Server IP>
3. Do not use the hostname as DNS servers may not have it registered properly or at all if it is not domain joined.

Google Sites

Report abuse