How to Configure the Windows Time Service on the PDC Emulator with Group Policy

Summary: The domain controller (DC) that holds the PDC Emulator role serves as the authoritative time source for its domain. For this reason, the PDC Emulator in the root domain must obtain its time from an external source. Everything else in the forest should obtain time from the domain hierarchy. When the PDC Emulator role is transferred to another DC, forgetting to change its time source can result in loss of accurate time throughout the domain. This article shows how to use Group Policy and a WMI filter to configure the PDC Emulator to synchronize with an external time source. If the PDC Emulator role is transferred to another DC, the WMI filter updates the new DC's configuration automatically at the next policy refresh. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

In this article, a Group Policy object (GPO) is created to configure the Windows Time service to synchronize with one or more external sources. A WMI filter is then used with the GPO to restrict this configuration to the PDC Emulator. Everything else in the domain should get time from the directory service hierarchy, which is the default behavior for domain-joined systems.
 

Note: In a multi-domain forest, only the PDC Emulator in the forest root domain must synchronize with an external source. The PDC Emulator in a child domain should synchronize with the domain hierarchy.



The WMI filter should be created first by following these steps:

  1. On a DC, launch Group Policy Management by selecting it from the Tools menu of Server Manager.
  2. In the left pane of the Group Policy Management console, right-click WMI Filters and select New.
  3. In the New WMI Filter window, supply a name for the filter (for example, PDC Emulator WMI Filter). Optionally, supply a description as well.
  4. Click the Add button.
  5. Confirm that root\CIMv2 is specified in the Namespace field. (It should be by default.)
  6. In the Query field, type Select * from Win32_ComputerSystem where DomainRole=5 and click OK.
  7. Click Save to save the filter. Do not close Group Policy Management.

Next, the GPO can be created by following these steps:

  1. In the left pane of Group Policy Management, right-click Group Policy Objects and select New.
  2. In the New GPO window, give the new GPO a name and click OK.
  3. Select Group Policy Objects in the left pane (if not already selected). Right-click the new GPO and select Edit.
  4. In the left pane of Group Policy Management Editor, expand Computer Configuration, Policies, Administrative Templates, System, and Windows Time Service. Select Time Providers.
  5. Right-click Configure Windows NTP Client and select Edit.
  6. Select the Enabled radio button.
  7. From the Type dropdown list, select NTP.
  8. In the NtpServer field, type the name or IP address of one or more NTP servers. Use spaces to separate entries in this list. Each entry should have the 0x8 flag appended to it with a comma (for example, pool.ntp.org,0x8 time.windows.com,0x8). Lists of public NTP servers can be found online.
  9. The other policy settings can typically be left at their default values. Click OK.
  10. Right-click Enable Windows NTP Client and select Edit.
  11. Select the Enabled radio button and click OK.
  12. Close Group Policy Management Editor.

Apply the WMI filter to the GPO by following these steps:

  1. In the left pane of Group Policy Management, expand Group Policy Objects and select the GPO that you created.
  2. In the center pane, select the Scope tab and scroll down to the WMI Filtering section.
  3. Click the dropdown menu and select the WMI filter. Click Yes to confirm.

Once the GPO has been created and the WMI filter applied to it, the GPO must be linked to the Domain Controllers organizational unit (OU). To do this, right-click Domain Controllers in the left pane of Group Policy Management and select Link an existing GPO. Select the GPO that you created and click OK.

From an elevated command prompt on the PDC Emulator, run gpupdate /force to refresh Group Policy. When the policy refresh completes, run w32tm /query /configuration. Settings configured by the GPO will show (Policy) after their values. Finally, run w32tm /query /status to confirm that the DC's clock has synchronized successfully with one of the time sources specified in the GPO.

 

This video provides a demonstration of this procedure:

Configure Time on the PDC Emulator with Group Policy

Duration: 00:10:23 (hh:mm:ss)
When available, closed caption (subtitles) language settings can be chosen using the CC icon on this video player.

Additional Information

A second GPO can be created to ensure that all other domain-joined machines obtain time from the domain hierarchy. Within this GPO, in the same location as above (Configure Windows NTP Client), set Type to NT5DS. Link this GPO to the domain.

Affected Products

Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows 2008 Server R2, Microsoft Windows 2008 Server Service Pack 2, Microsoft Windows 2012 Server, Microsoft Windows 2012 Server R2
Article Properties
Article Number: 000215683
Article Type: How To
Last Modified: 11 Nov 2024
Version:  4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.