W23time

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hi all,

I am looking for help with some errors/warnings I'm trying to pin down which
may or may not be connected. My first problems comes with setting a
timeserver for my domain. (errors 54 & 64) The next errors I have concern
about are 13508 followed by 13509 these are Ntfrs relating replication. I
will say at this point that everything seems to work fine on the network and
also that this was not always the case as when taking over the network FRS
was corrupt on one DC with various missing ojects having been deleted
incorrectly. These have now been resolved and GP's etc work again.

I have stopped it producing the 54 & 64 errors I think by changing the PDC
ie MQLserver1 reg key type to NoSync. I mean all servers and PC’s seem to be
keeping perfect time so I’m not too worried too much at the mo. But I would
like to verify this and that things are ok. I have ran a little util called
DCdiag which runs various tests which our DC’s seem to pass with the odd blip
stating brief replication problems but they do clear and seem to replicate in
the end.

I promoted one server to a DC and checked all the log files AD produced in
this process ie dcpromo.log etc all look fine to me

I’m really not sure if all the machines are using the server MQLserver1 as
the time server, which is obviously the one we want it to use as this hold
the PDC role. When I put in net time it gives one of the other DC which
should'nt be giving the time. When I use net time /querysntp it gives what
I’d expect mqlserver1 as this is what I set it to. Now when I run this
command on the computers that have not been configured just get message
stating no sntp server has been specified. So how do all computers keep time
sync'd and they are all dead on or seem to be. I think the network must be
using some other process but I can’t find anything on how it works.

The other thing I found is UDP port 123 needs to be open on the firewall as
this allows SNTP traffic but this would only apply if we set it to an
external time source (which we can do if it sorts the problem). I have also
tried to set it to an external source going over the Microsoft knowledgebase
articles twice to make sure I have the right reg entries. Really beats me now
and its not even mentioned in any AD books that I have!

Cheers

Steven

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hi Steven:
For your time problem, perhaps you might find it useful to know our
configuration. We picked one DC to be the primary domain time source, in
our case the one with the PDC role. Using the net time command, we set it
to synchronize time with one of the Navy time servers on the Internet. Then
we set all other servers, DCs and member servers alike, again using the "net
time /setsntp" command to point to the primary time server. We also added
that as a step in our server build checklist. Works fine, keeps good time.

We also have your situation where a "net time /set" will point to a
different server than our primary time server. I believe there is a certain
hierarchy among the DCs in a domain that explains it. If you use the netdom
utility from the Win2k Support Tools, and run "netdom query dc", you will
get a list of all of your DCs. The list is always in the same order and if
you get the results we do, the DC at the top of the list is the one that
always answers a "net time" query. BTW, the "netdom query fsmo" is the
easiest way I know of to find out which roles are on which DCs. Lots of
good options with netdom. Hope this helps.

Wendell

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

ok thanks, that explains the net time command results better now and I'll
have a look at the netdom util. Thanks once again!
--
Steven


"Wendell Lummis" wrote:

> Hi Steven:
> For your time problem, perhaps you might find it useful to know our
> configuration. We picked one DC to be the primary domain time source, in
> our case the one with the PDC role. Using the net time command, we set it
> to synchronize time with one of the Navy time servers on the Internet. Then
> we set all other servers, DCs and member servers alike, again using the "net
> time /setsntp" command to point to the primary time server. We also added
> that as a step in our server build checklist. Works fine, keeps good time.
>
> We also have your situation where a "net time /set" will point to a
> different server than our primary time server. I believe there is a certain
> hierarchy among the DCs in a domain that explains it. If you use the netdom
> utility from the Win2k Support Tools, and run "netdom query dc", you will
> get a list of all of your DCs. The list is always in the same order and if
> you get the results we do, the DC at the top of the list is the one that
> always answers a "net time" query. BTW, the "netdom query fsmo" is the
> easiest way I know of to find out which roles are on which DCs. Lots of
> good options with netdom. Hope this helps.
>
> Wendell
>