Using Powershell to Fix AD Time Drift.

 

Time syncing AD Controllers is an on going bane.  Since I've been working as a system administrator; Active directory time sync has been a problem in most places I've been; with the system time being off by a few seconds up to 15 minutes.  

I wrote a post back in 2001 about fixing AD Time drift using a registry entry for clients and servers, which has worked fine for the most part.  Recently though the power was shut off in our main data center; so we shut down all our systems for the night till power was to be restored because we didn't have a UPS systems that could run for the length of the outage.  

When the outage was over and I turned the servers I had one active directory controller off by 5 minutes and the other off by 7 (using my watch as the source for time).  I fixed the clocks manually so they were within a few seconds of each other but wanted a better solution.

So I decided to write a powershell script to update the time.  On the AD Controllers in my org W32tm is stopped and not running.  So I am going to setup task scheduler to run this on a schedule that I have yet to determine.  For now though I've written this script; where $TimeServer is a network time server such as time.windows.com or time.apple.com or some other ntp server or IP.

updatetime.ps1

net start W32time

W32tm /config /manualpeerlist:$TimeServer,0x8 /reliable:yes /update

w32tm.exe /config /update

W32tm /resync /force

net stop W32time

So you have to make sure powershell scripts are permitted to run.

To run the powershell script with task scheduler I use a bat file to execute it.

@ECHO OFF

powershell.exe -executionpolicy remotesigned -File $PATH/$TOSCRIPT.ps1

Now after running my powershell script on both AD Controllers they are now in perfect sync.

Sources:

https://optionkey.blogspot.com/2021/01/ad-time-drift-and-how-to-fix-it.html

https://www.checkyourlogs.net/windows-time-sync-the-fixes/

https://learn.microsoft.com/en-us/services-hub/health/remediation-steps-ad/configure-the-root-pdc-with-an-authoritative-time-source-and-avoid-widespread-time-skew

AD Time drift - and how to fix it

 

Over a period of time and windows updates especially if your using a virtualized ad controller or a mix of hardware and vm controllers, time can start to drift.  If your maintaining your own time server good on you but most of us don't; we sync to a time server and occasionally it needs to be resynced.  

After four years and several power outages this happened to a physical and virtual active directory controller, they had a time drift of over 2 minutes and it was causing issues with DNS and DHCP.

To check your current timesync settings open regedit and go to 

\HKEY_LOCAL_Machine\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

You will find a parameter called NTPServer

As you can see in the image above, the ntpserver value is set to time.windows.com. 

The following command will update your server time and set your NTP server to timerserver1 and timeserver 2 which can be any valid time servers you want it to be.

C:\Windows\system32>w32tm /config /syncfromflags:manual /manualpeerlist:"0.time.timeserver1.com 1.time.timerserver2.com"

This will update your NTPServer value with the time servers you specify in timeserver1 and timeserver2.

You can check your windows task scheduler to see if you have had any issues with running the time sync by go to.

Task Scheduler -> Microsoft ->Windows -> Time Synchronization

You will want to run this on both Active Directory controllers and it should fix your time sync issue.