AD Time drift - and how to fix it

 

Over a period of time and windows updates especially if your using a virtualized ad controller or a mix of hardware and vm controllers, time can start to drift.  If your maintaining your own time server good on you but most of us don't; we sync to a time server and occasionally it needs to be resynced.  

After four years and several power outages this happened to a physical and virtual active directory controller, they had a time drift of over 2 minutes and it was causing issues with DNS and DHCP.

To check your current timesync settings open regedit and go to 

\HKEY_LOCAL_Machine\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

You will find a parameter called NTPServer

As you can see in the image above, the ntpserver value is set to time.windows.com. 

The following command will update your server time and set your NTP server to timerserver1 and timeserver 2 which can be any valid time servers you want it to be.

C:\Windows\system32>w32tm /config /syncfromflags:manual /manualpeerlist:"0.time.timeserver1.com 1.time.timerserver2.com"

This will update your NTPServer value with the time servers you specify in timeserver1 and timeserver2.

You can check your windows task scheduler to see if you have had any issues with running the time sync by go to.

Task Scheduler -> Microsoft ->Windows -> Time Synchronization

You will want to run this on both Active Directory controllers and it should fix your time sync issue.