Windows Time Servers

Is it advisable to direct all of my servers to use time.windows.com,0x8 as
their source of time or is that a no-no? (around 60 servers)
Right now they are set to use the DC in their site and those DCs are set to
use the PDC and the PDC is set to use time.windows.com,0x8 but I am getting
errors on the PDC and the rest of the servers. "The time provider NtpClient
cannot reach or is currently receiving invalid time data from (PDC and
time.windows.com)"
There are no connectivity issues, all servers can see each other.
We have a firewall rule that allows UDP port 123 out and in from the PDC to
time.windows.com(207.46.130.100)
Thanks.

"Net Admin" <NetAdmin@discussions.microsoft.com> wrote in message
news:8FD2E391-A36B-44E5-AFFD-72C1DD698758@microsoft.com...
> Is it advisable to direct all of my servers to use time.windows.com,0x8 as
> their source of time or is that a no-no? (around 60 servers)

No, generally they should just be left alone.

The PDC Emulator should sync time from a known good source,
or from another machine specifically tasked with this job.

All other DCs will sync from the PDC Emulator; all non-DCs will
sync from authenticating DC and it will just work.

(Child PDC-Emulators sync from the parent one too.)

> Right now they are set to use the DC in their site and those DCs are set
> to
> use the PDC and the PDC is set to use time.windows.com,0x8 but I am
> getting
> errors on the PDC and the rest of the servers. "The time provider
> NtpClient
> cannot reach or is currently receiving invalid time data from (PDC and
> time.windows.com)"
> There are no connectivity issues, all servers can see each other.
> We have a firewall rule that allows UDP port 123 out and in from the PDC
> to
> time.windows.com(207.46.130.100)

Nothing specially about time.windows.com either -- you can use it or any
others
that are reliable for you (maybe several.)


> Thanks.

Thank You Herb.

"Herb Martin" wrote:

>
> "Net Admin" <NetAdmin@discussions.microsoft.com> wrote in message
> news:8FD2E391-A36B-44E5-AFFD-72C1DD698758@microsoft.com...
> > Is it advisable to direct all of my servers to use time.windows.com,0x8 as
> > their source of time or is that a no-no? (around 60 servers)
>
> No, generally they should just be left alone.
>
> The PDC Emulator should sync time from a known good source,
> or from another machine specifically tasked with this job.
>
> All other DCs will sync from the PDC Emulator; all non-DCs will
> sync from authenticating DC and it will just work.
>
> (Child PDC-Emulators sync from the parent one too.)
>
> > Right now they are set to use the DC in their site and those DCs are set
> > to
> > use the PDC and the PDC is set to use time.windows.com,0x8 but I am
> > getting
> > errors on the PDC and the rest of the servers. "The time provider
> > NtpClient
> > cannot reach or is currently receiving invalid time data from (PDC and
> > time.windows.com)"
> > There are no connectivity issues, all servers can see each other.
> > We have a firewall rule that allows UDP port 123 out and in from the PDC
> > to
> > time.windows.com(207.46.130.100)
>
> Nothing specially about time.windows.com either -- you can use it or any
> others
> that are reliable for you (maybe several.)
>
>
> > Thanks.
>
>
>

On Thu, 7 Jun 2007 13:32:01 -0700, Net Admin
<NetAdmin@discussions.microsoft.com> wrote:

>Is it advisable to direct all of my servers to use time.windows.com,0x8 as
>their source of time or is that a no-no? (around 60 servers)
>Right now they are set to use the DC in their site and those DCs are set to
>use the PDC and the PDC is set to use time.windows.com,0x8 but I am getting
>errors on the PDC and the rest of the servers. "The time provider NtpClient
>cannot reach or is currently receiving invalid time data from (PDC and
>time.windows.com)"
>There are no connectivity issues, all servers can see each other.
>We have a firewall rule that allows UDP port 123 out and in from the PDC to
>time.windows.com(207.46.130.100)
>Thanks.


Keep the servers pointed to the PDC emulator, then make the PDC
emulator look at a different source. time.windows.com seems to be
having a lot of trouble lately.

time-a.nist.gov
time-b.nist.gov

are two fairly reliable sources

Mike

"Special Access" <nonyabidnezz@hotmail.com> wrote in message
news:0k5h6392j33v3feiqa4curhs4uu72ujguu@4ax.com...
> On Thu, 7 Jun 2007 13:32:01 -0700, Net Admin
> <NetAdmin@discussions.microsoft.com> wrote:
>
>>Is it advisable to direct all of my servers to use time.windows.com,0x8 as
>>their source of time or is that a no-no? (around 60 servers)
>>Right now they are set to use the DC in their site and those DCs are set
>>to
>>use the PDC and the PDC is set to use time.windows.com,0x8 but I am
>>getting
>>errors on the PDC and the rest of the servers. "The time provider
>>NtpClient
>>cannot reach or is currently receiving invalid time data from (PDC and
>>time.windows.com)"
>>There are no connectivity issues, all servers can see each other.
>>We have a firewall rule that allows UDP port 123 out and in from the PDC
>>to
>>time.windows.com(207.46.130.100)
>>Thanks.
>
>
> Keep the servers pointed to the PDC emulator,

Keep the DCs (not servers per se) pointed at the PDC Emulator.

Ordinary servers should be treated just like workstations most all of
the time.

> then make the PDC
> emulator look at a different source. time.windows.com seems to be
> having a lot of trouble lately.

If that is the case then others should be picked -- there is NOTHING
special about windows.com -- find SEVERAL that are reliable (for
you) and set them for the time master (for the domain this is the PDC
emulator.)

Set the PDC Emulator to these external time servers OR set it to
another (usually in the DMZ area) that is then set to the Internet
time servers (two step mastering.)

> time-a.nist.gov
> time-b.nist.gov
>
> are two fairly reliable sources
>
> Mike

Thank you both for your input. Now I have one more question....
Do I need to also open up port 37 form my PDC to the Internet time source?

"Herb Martin" wrote:

>
> "Special Access" <nonyabidnezz@hotmail.com> wrote in message
> news:0k5h6392j33v3feiqa4curhs4uu72ujguu@4ax.com...
> > On Thu, 7 Jun 2007 13:32:01 -0700, Net Admin
> > <NetAdmin@discussions.microsoft.com> wrote:
> >
> >>Is it advisable to direct all of my servers to use time.windows.com,0x8 as
> >>their source of time or is that a no-no? (around 60 servers)
> >>Right now they are set to use the DC in their site and those DCs are set
> >>to
> >>use the PDC and the PDC is set to use time.windows.com,0x8 but I am
> >>getting
> >>errors on the PDC and the rest of the servers. "The time provider
> >>NtpClient
> >>cannot reach or is currently receiving invalid time data from (PDC and
> >>time.windows.com)"
> >>There are no connectivity issues, all servers can see each other.
> >>We have a firewall rule that allows UDP port 123 out and in from the PDC
> >>to
> >>time.windows.com(207.46.130.100)
> >>Thanks.
> >
> >
> > Keep the servers pointed to the PDC emulator,
>
> Keep the DCs (not servers per se) pointed at the PDC Emulator.
>
> Ordinary servers should be treated just like workstations most all of
> the time.
>
> > then make the PDC
> > emulator look at a different source. time.windows.com seems to be
> > having a lot of trouble lately.
>
> If that is the case then others should be picked -- there is NOTHING
> special about windows.com -- find SEVERAL that are reliable (for
> you) and set them for the time master (for the domain this is the PDC
> emulator.)
>
> Set the PDC Emulator to these external time servers OR set it to
> another (usually in the DMZ area) that is then set to the Internet
> time servers (two step mastering.)
>
> > time-a.nist.gov
> > time-b.nist.gov
> >
> > are two fairly reliable sources
> >
> > Mike
>
>
>