In a “normal” (read: physical) domain environment, all the domain member machines such as servers and PCs use the PDC (Primary Domain Controller) as the authoritiative time source. This keeps all the machines in a domain synchronised to within a few milliseconds and avoids any problems due to time mismatch. (If you’ve ever tried to join a PC to a domain with a significantly different time setting, you’ll see how this can affect active directory operations).
However, virtual machines are slightly different. VMs use their virtual host as the authoritative time server – it’s essential that the virtual host and the guests operate on the same time. Run the below command in a command prompt on a VM:
C:\>w32tm /query /source
And it should return:
VM IC Time Synchronization Provider
If you run the same command on the host itself, it’ll just return the name of one of the domain controllers in your network (probably, but not necessarily, the PDC).
Now, what if your domain controllers are virtual? They’ll be using their host machine’s time as the source, but the hosts themselves will be using the PDC as an authoritative time source – the problem is clear: they’re using each other as authoritative time sources and network time will slowly drift away from the correct time.
You may decide to disable integration services for the guest (the PDC), and configure an authoritative external time source, but if the PDC is rebooted or goes offline and comes back online with a different time than the host (such as a restore), you’ll have problems. Granted, this should fix 90% of issues, but I wouldn’t recommend it as a solution.
In an ideal world, you’d still have at least one physical PDC, which would use an external time source, and would serve time to all other machines in the network, but if your infrastructure is such that you only have virtual domain controllers, you’ll need to do something a little different. The best way to this is to set your virtual hosts to use the same external (reliable) time source. This does of course require that your virtual hosts have access to the internet, but at least you should be able to add firewall rules to enable access to a fixed range of NTP servers, which should pose no security threat.
To do this, log on to your (windows) virtual host (in this case, I’m using Hyper-V server 2008 R2).
Run
C:\>w32tm /query /source
And it’ll return one of the domain controllers.
Use the command prompt to open regedit, and navigate to HKLM-System-CurrentControSet-services-w32time-parameters.
It’ll probably look like this:
Change the “Type” entry to “NTP” and if you desire, change the NtpServer entry to something other than windows time, although you can leave it if you wish.
Now that you’ve changed the registry entries, run:
net stop w32time & net start w32time
then
w32tm /query /source
And it should return the new internet time servers.
Run:
w32tm /resync /force
to force a resync of the machine’s clock.
Log on to the virtual machine running on this host, and check the time. Force a resync if you want – it won’t do any harm, and at least you’ll know it’s synced.
If you now run:
W32tm /monitor
on any machine, it will display the potential time servers in your network, and the time offset between them. If all is correct in your network, the offset should be pretty small (though it will never be zero)
domaincontroller1.domain.local *** PDC ***[ipaddress:123]:
ICMP: 0ms delay
NTP: +0.0000000s offset from domaincontroller2.domain.local
RefID: 80.84.77.86.rev.sfr.net [86.77.84.80]
Stratum: 2
domaincontroller2.domain.local[ipaddress:123]:
ICMP: 0ms delay
NTP: -0.0827715s offset from domaincontroller1.local
RefID: 80.84.77.86.rev.sfr.net [86.77.84.80]
Stratum: 2
Warning:
Reverse name resolution is best effort. It may not be
correct since RefID field in time packets differs across
NTP implementations and may not be using IP addresses.
If you find a domain member machine (whether it’s a server or simple client) which is not set to use the proper domain NTP server, run the below command:
w32tm /config /syncfromflags:DOMHIER /update
This command instructs the machine to search for and use the best time source in a domain hierarchy.