Fix time sync in an Active Directory domain

Kerberos rejects tickets when clocks differ by more than 5 minutes (the default). In a domain, time should flow from one place: the PDC emulator in the forest root domain syncs to an external source, and everything else syncs from the domain.

Symptoms

• Clocks differ between PCs and servers, or drift over days.
• Sign-in failures, or Kerberos errors such as event 4 and pre-authentication failures.
• Replication or VPN problems that clear up after a manual time fix.

Cause

• The PDC emulator syncs from its own CMOS clock (Local CMOS Clock) or a hypervisor, not a real time source.
• Domain members were manually pointed at an external NTP server, bypassing the hierarchy.
• A virtualized DC gets time from the host through time synchronization integration, fighting with NTP.
• Outbound UDP 123 is blocked at the firewall.

Fix

1. Find the PDC emulator

netdom query fsmo

2. Configure the PDC emulator

On the PDC emulator, in an elevated prompt:

w32tm /config /manualpeerlist:"0.ca.pool.ntp.org,0x8 1.ca.pool.ntp.org,0x8 2.ca.pool.ntp.org,0x8" /syncfromflags:manual /reliable:yes /update
net stop w32time && net start w32time
w32tm /resync /rediscover

Allow outbound UDP 123 from the PDC emulator.

3. Point every other machine at the domain

On other DCs and any member that was manually configured:

w32tm /config /syncfromflags:domhier /update
net stop w32time && net start w32time

4. Check the result

w32tm /query /status
w32tm /query /source

The PDC should show your NTP peers. Other DCs should show a DC, and members should show a DC, not Local CMOS Clock.

5. Virtual DCs

On Hyper-V, disable Time synchronization in the DC’s Integration Services (VMware has an equivalent setting in VMware Tools), so the DC follows the domain hierarchy instead of the host.

If that didn’t work

• Compare the offset to the PDC: w32tm /stripchart /computer:<pdc> /samples:5 /dataonly.
• If you move the PDC emulator role, reconfigure the new PDC and set the old one back to domhier.

When to call us

• Time is off by hours, or clocks jump back and forth.
• You’re moving FSMO roles or virtualizing your DCs.