Perfect Timing

Windows 2000 includes the Windows Time service (W32Time), which you can use to make sure that all Windows XP and Win2K computers on your network run on the same time. W32Time synchronizes a computer you designate as an authoritative time server with an outside time source, then synchronizes all computers on your network to that time server. Let's examine W32Time and discuss how to configure and administer the service on your network.

If you choose not to use W32Time on your network, you might not notice any obvious consequences. However, several features and processes depend on accurate and synchronized timestamps. Kerberos, for example, requires timestamps as part of the authentication ticket generation process. By default, Kerberos authentication fails if the clock time of the client computer and the authenticating domain controller (DC) are more than 5 minutes apart. This interval is called the Maximum Tolerance for Synchronization of Computer Clocks. You can use Group Policy to change this value, but doing so can weaken security on your network.

Replication processes on the network also depend on accurate timestamps as they determine whether to replicate data. In fact, if the time difference between two DCs is greater than the Kerberos Maximum Tolerance for Synchronization of Computer Clocks, authentication between DCs fails, and that failure causes DC data replications to fail. Just as important, computers with different times can wreak havoc on data file writes. And inaccurate timestamps can compromise functions such as synchronizing offline files, entering database data, and working with collaborative documents.

Setting Up an Authoritative Time Server
The authoritative time server is a DC that checks its time against an outside clock deemed to be extremely accurate. If you have multiple DCs in a domain, the authoritative time server is the DC that serves as the Flexible Single-Master Operation (FSMO) PDC emulator. By default, the FSMO PDC emulator is the first DC that you install in a domain. If you have multiple domains (i.e., a forest), the FSMO PDC emulator of the first domain you created in the forest is the authoritative time server for the forest.

You must supply the URL or IP address of the authoritative external clock by entering the following command on the DC that serves as the authoritative time server:

net time /setsntp:(server_ address or server_list)

The target external server must be a Simple Network Time Protocol (SNTP) time server, and UDP port 123 must be open to the Internet. See the sidebar "Locating Time Servers," page 74, for addresses of time servers near you. If you provide a list of target external servers (i.e., so that if one external server isn't available, the system can try to contact another server), follow each address with a space and enclose the entire list in quotation marks, as in the following example:

net time /setsntp:"192.5.41.209 192.5.41.41"

   Previous  [1]  2  3  4  Next