Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Active Directory » Setting up Time
Setting up Time [message #160915] Thu, 10 September 2009 10:43 Go to next message
Charles  is currently offline Charles
Messages: 71
Registered: July 2009
Member
In a domain where there is a root domain and a few subdomains (may not make a
difference) should the MaxPosPhaseCorrection and MaxNegPhaseCorrection values
just need to be set on all domain controllers or all of the domain
controllers including the servers and clients? Clients are XPsp2 and servers
are all W2k3sp2.

Thanks,
Chuck
Re: Setting up Time [message #160918 is a reply to message #160915] Thu, 10 September 2009 11:06 Go to previous messageGo to next message
RC  is currently offline RC  United States
Messages: 62
Registered: July 2009
Member
i am confused by your question but if you are talking about the w32tim
and how it should be setup I would do the following.

choose one dc in the root domain (i always use the pdc) and set that
server to look at an external time source... example c:\net time /
setsntp:external.timesource.com or something to that extent. all the
other domain controllers in the forest should be left alone as they
will look up throughout the heirachy.

this is a good read: http://www.windowsnetworking.com/articles_tutorials/Configur ing-Windows-Time-Service.html
Re: Setting up Time [message #160921 is a reply to message #160915] Thu, 10 September 2009 11:18 Go to previous messageGo to next message
florian  is currently offline florian  Germany
Messages: 484
Registered: July 2009
Senior Member
Charles,

Charles schrieb:
> In a domain where there is a root domain and a few subdomains (may not make a
> difference) should the MaxPosPhaseCorrection and MaxNegPhaseCorrection values
> just need to be set on all domain controllers or all of the domain
> controllers including the servers and clients? Clients are XPsp2 and servers
> are all W2k3sp2.

I wouldn't touch the time settings at all unless there is a good reason
to do so. The domain hierarchy and the time services do their job pretty
well. Is there anything you're concerned about?

Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste
Re: Setting up Time [message #160926 is a reply to message #160915] Thu, 10 September 2009 12:07 Go to previous messageGo to next message
aceman  is currently offline aceman  United States
Messages: 5816
Registered: July 2009
Senior Member
"Charles" <Charles@discussions.microsoft.com> wrote in message
news:8D6FA637-D29D-4F03-A43E-8FFB545CD4DC@microsoft.com...
> In a domain where there is a root domain and a few subdomains (may not
> make a
> difference) should the MaxPosPhaseCorrection and MaxNegPhaseCorrection
> values
> just need to be set on all domain controllers or all of the domain
> controllers including the servers and clients? Clients are XPsp2 and
> servers
> are all W2k3sp2.
>
> Thanks,
> Chuck


As others mentioned, too much work and changes to something that works
perfectly by default. Let the domain hierarchy work, I've never had any
trouble with it, including when I worked at a 5000 user system with mutiple
child domains and AD global sites.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.
Re: Setting up Time [message #160929 is a reply to message #160926] Thu, 10 September 2009 12:33 Go to previous messageGo to next message
Charles  is currently offline Charles
Messages: 71
Registered: July 2009
Member
Thanks to the both of you! I just got a directive to change the default
value xffffffff to 48hrs for both MaxPosPhaseCorrection and
MaxNegPhaseCorrection. I just need to know if this change should only be
made on the root PDC or all DCs in the forest? My guess is just the root PDC
since as both of you mentioned that all other systems get the time from the
root PDC.

Thanks in advance.

Chuck

"Ace Fekay [MCT]" wrote:

> "Charles" <Charles@discussions.microsoft.com> wrote in message
> news:8D6FA637-D29D-4F03-A43E-8FFB545CD4DC@microsoft.com...
> > In a domain where there is a root domain and a few subdomains (may not
> > make a
> > difference) should the MaxPosPhaseCorrection and MaxNegPhaseCorrection
> > values
> > just need to be set on all domain controllers or all of the domain
> > controllers including the servers and clients? Clients are XPsp2 and
> > servers
> > are all W2k3sp2.
> >
> > Thanks,
> > Chuck
>
>
> As others mentioned, too much work and changes to something that works
> perfectly by default. Let the domain hierarchy work, I've never had any
> trouble with it, including when I worked at a 5000 user system with mutiple
> child domains and AD global sites.
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Please reply back to the newsgroup or forum for collaboration benefit among
> responding engineers, and to help others benefit from your resolution.
>
> Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
> Microsoft Certified Trainer
>
> For urgent issues, please contact Microsoft PSS directly. Please check
> http://support.microsoft.com for regional support phone numbers.
>
>
Re: Setting up Time [message #160941 is a reply to message #160929] Thu, 10 September 2009 18:33 Go to previous messageGo to next message
aceman  is currently offline aceman  United States
Messages: 5816
Registered: July 2009
Senior Member
"Charles" <Charles@discussions.microsoft.com> wrote in message
news:CCB1C000-FB0D-4A1F-9B6B-4135C68B4648@microsoft.com...

Curious, what was the decision and resulting directive based on? Did someone
run an AD BPA?

Well, the reason to set it at the forest root PDC is because it's set
(assuming so) to get time sync from an outside source on the internet. I
spent a little time reading the following article, and it states to set it
on all DCs, not just the PDC Emulator in the root. It also suggests doing it
in a GPO for the DCs to keep consistent. I would suggest creating (don't
alter the default domain controller GPO) a new GPO with these settings in
all your domain's DC OU.

I've just never encountered any issue with time offset as the article
implies, even in large infrastructures. I would imagine that the powers that
be have a good reason to do it, possibly that they've encountered an issue?
If so, I would suspect the time source.

How to configure the Windows Time service against a large time offset
http://support.microsoft.com/kb/884776

Ace


> Thanks to the both of you! I just got a directive to change the default
> value xffffffff to 48hrs for both MaxPosPhaseCorrection and
> MaxNegPhaseCorrection. I just need to know if this change should only be
> made on the root PDC or all DCs in the forest? My guess is just the root
> PDC
> since as both of you mentioned that all other systems get the time from
> the
> root PDC.
>
> Thanks in advance.
>
> Chuck
>
> "Ace Fekay [MCT]" wrote:
>
>> "Charles" <Charles@discussions.microsoft.com> wrote in message
>> news:8D6FA637-D29D-4F03-A43E-8FFB545CD4DC@microsoft.com...
>> > In a domain where there is a root domain and a few subdomains (may not
>> > make a
>> > difference) should the MaxPosPhaseCorrection and MaxNegPhaseCorrection
>> > values
>> > just need to be set on all domain controllers or all of the domain
>> > controllers including the servers and clients? Clients are XPsp2 and
>> > servers
>> > are all W2k3sp2.
>> >
>> > Thanks,
>> > Chuck
>>
>>
>> As others mentioned, too much work and changes to something that works
>> perfectly by default. Let the domain hierarchy work, I've never had any
>> trouble with it, including when I worked at a 5000 user system with
>> mutiple
>> child domains and AD global sites.
>>
>> --
>> Ace
>>
>> This posting is provided "AS-IS" with no warranties or guarantees and
>> confers no rights.
>>
>> Please reply back to the newsgroup or forum for collaboration benefit
>> among
>> responding engineers, and to help others benefit from your resolution.
>>
>> Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
>> Microsoft Certified Trainer
>>
>> For urgent issues, please contact Microsoft PSS directly. Please check
>> http://support.microsoft.com for regional support phone numbers.
>>
>>
Re: Setting up Time [message #160948 is a reply to message #160915] Fri, 11 September 2009 00:20 Go to previous messageGo to next message
meiweb  is currently offline meiweb  Germany
Messages: 2225
Registered: September 2009
Senior Member
Hello charles,

As stated from the others, leave the time sync process and settings in the
domain by default, if you don't experience any problems. Windows handles
this really good.

Here is a really good article about:
http://blogs.msdn.com/w32time/default.aspx

Also check:
http://support.microsoft.com/kb/816042

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> In a domain where there is a root domain and a few subdomains (may not
> make a difference) should the MaxPosPhaseCorrection and
> MaxNegPhaseCorrection values just need to be set on all domain
> controllers or all of the domain controllers including the servers and
> clients? Clients are XPsp2 and servers are all W2k3sp2.
>
> Thanks,
> Chuck
Re: Setting up Time [message #160957 is a reply to message #160941] Fri, 11 September 2009 06:37 Go to previous messageGo to next message
Charles  is currently offline Charles
Messages: 71
Registered: July 2009
Member
Thanks Ace and Meinolf for your responses. Thanks millions for the info. And
yes, that is the article that I have reviewed
http://support.microsoft.com/kb/884776. We had a Microsoft person here that
came out to review our forrest. He ran some kind of internal BPA-ish kind of
tool. It spotted that the time client on all systems will accept all time
samples and recommended that we change it. He gave us the article you'd
mentioned and that is included in my response.

It basically tells us to change the two values in the registry to accept
only time samples of 48hours. This is so the time in our forrest won't get
set to something way off in advance or in the past. The only thing that was
unclear is if we should set it on ALL systems including clients and servers
or just on domain controllers.

It makes since just to set it on domain controllers since clients and
servers will only receive time from DCs (pdc emulator in root domain).

So Ace, I will recommend this be set on only our DCs in the forest (48hours).

Thanks much,
Chuck

"Ace Fekay [MCT]" wrote:

> "Charles" <Charles@discussions.microsoft.com> wrote in message
> news:CCB1C000-FB0D-4A1F-9B6B-4135C68B4648@microsoft.com...
>
> Curious, what was the decision and resulting directive based on? Did someone
> run an AD BPA?
>
> Well, the reason to set it at the forest root PDC is because it's set
> (assuming so) to get time sync from an outside source on the internet. I
> spent a little time reading the following article, and it states to set it
> on all DCs, not just the PDC Emulator in the root. It also suggests doing it
> in a GPO for the DCs to keep consistent. I would suggest creating (don't
> alter the default domain controller GPO) a new GPO with these settings in
> all your domain's DC OU.
>
> I've just never encountered any issue with time offset as the article
> implies, even in large infrastructures. I would imagine that the powers that
> be have a good reason to do it, possibly that they've encountered an issue?
> If so, I would suspect the time source.
>
> How to configure the Windows Time service against a large time offset
> http://support.microsoft.com/kb/884776
>
> Ace
>
>
> > Thanks to the both of you! I just got a directive to change the default
> > value xffffffff to 48hrs for both MaxPosPhaseCorrection and
> > MaxNegPhaseCorrection. I just need to know if this change should only be
> > made on the root PDC or all DCs in the forest? My guess is just the root
> > PDC
> > since as both of you mentioned that all other systems get the time from
> > the
> > root PDC.
> >
> > Thanks in advance.
> >
> > Chuck
> >
> > "Ace Fekay [MCT]" wrote:
> >
> >> "Charles" <Charles@discussions.microsoft.com> wrote in message
> >> news:8D6FA637-D29D-4F03-A43E-8FFB545CD4DC@microsoft.com...
> >> > In a domain where there is a root domain and a few subdomains (may not
> >> > make a
> >> > difference) should the MaxPosPhaseCorrection and MaxNegPhaseCorrection
> >> > values
> >> > just need to be set on all domain controllers or all of the domain
> >> > controllers including the servers and clients? Clients are XPsp2 and
> >> > servers
> >> > are all W2k3sp2.
> >> >
> >> > Thanks,
> >> > Chuck
> >>
> >>
> >> As others mentioned, too much work and changes to something that works
> >> perfectly by default. Let the domain hierarchy work, I've never had any
> >> trouble with it, including when I worked at a 5000 user system with
> >> mutiple
> >> child domains and AD global sites.
> >>
> >> --
> >> Ace
> >>
> >> This posting is provided "AS-IS" with no warranties or guarantees and
> >> confers no rights.
> >>
> >> Please reply back to the newsgroup or forum for collaboration benefit
> >> among
> >> responding engineers, and to help others benefit from your resolution.
> >>
> >> Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
> >> Microsoft Certified Trainer
> >>
> >> For urgent issues, please contact Microsoft PSS directly. Please check
> >> http://support.microsoft.com for regional support phone numbers.
> >>
> >>
>
>
>
Re: Setting up Time [message #160961 is a reply to message #160957] Fri, 11 September 2009 08:00 Go to previous message
aceman  is currently offline aceman  United States
Messages: 5816
Registered: July 2009
Senior Member
"Charles" <Charles@discussions.microsoft.com> wrote in message
news:FE695DD2-5E7B-4C29-A05D-4300AC81E417@microsoft.com...

Thanks for the explanation. I was curious, and if you had a Microsoft tech
onsite, it would be a good thing to follow his advise. They probably used
the new AD DS BPA:

Introducing AD DS Best Practices Analyzer
http://blogs.technet.com/activedirectoryua/archive/2009/01/3 0/introducing-ad-ds-best-practices-analyzer.aspx

Glad to be of help, too!

Ace


> Thanks Ace and Meinolf for your responses. Thanks millions for the info.
> And
> yes, that is the article that I have reviewed
> http://support.microsoft.com/kb/884776. We had a Microsoft person here
> that
> came out to review our forrest. He ran some kind of internal BPA-ish kind
> of
> tool. It spotted that the time client on all systems will accept all time
> samples and recommended that we change it. He gave us the article you'd
> mentioned and that is included in my response.
>
> It basically tells us to change the two values in the registry to accept
> only time samples of 48hours. This is so the time in our forrest won't
> get
> set to something way off in advance or in the past. The only thing that
> was
> unclear is if we should set it on ALL systems including clients and
> servers
> or just on domain controllers.
>
> It makes since just to set it on domain controllers since clients and
> servers will only receive time from DCs (pdc emulator in root domain).
>
> So Ace, I will recommend this be set on only our DCs in the forest
> (48hours).
>
> Thanks much,
> Chuck
>
> "Ace Fekay [MCT]" wrote:
>
>> "Charles" <Charles@discussions.microsoft.com> wrote in message
>> news:CCB1C000-FB0D-4A1F-9B6B-4135C68B4648@microsoft.com...
>>
>> Curious, what was the decision and resulting directive based on? Did
>> someone
>> run an AD BPA?
>>
>> Well, the reason to set it at the forest root PDC is because it's set
>> (assuming so) to get time sync from an outside source on the internet. I
>> spent a little time reading the following article, and it states to set
>> it
>> on all DCs, not just the PDC Emulator in the root. It also suggests doing
>> it
>> in a GPO for the DCs to keep consistent. I would suggest creating (don't
>> alter the default domain controller GPO) a new GPO with these settings in
>> all your domain's DC OU.
>>
>> I've just never encountered any issue with time offset as the article
>> implies, even in large infrastructures. I would imagine that the powers
>> that
>> be have a good reason to do it, possibly that they've encountered an
>> issue?
>> If so, I would suspect the time source.
>>
>> How to configure the Windows Time service against a large time offset
>> http://support.microsoft.com/kb/884776
>>
>> Ace
>>
>>
>> > Thanks to the both of you! I just got a directive to change the
>> > default
>> > value xffffffff to 48hrs for both MaxPosPhaseCorrection and
>> > MaxNegPhaseCorrection. I just need to know if this change should only
>> > be
>> > made on the root PDC or all DCs in the forest? My guess is just the
>> > root
>> > PDC
>> > since as both of you mentioned that all other systems get the time from
>> > the
>> > root PDC.
>> >
>> > Thanks in advance.
>> >
>> > Chuck
>> >
>> > "Ace Fekay [MCT]" wrote:
>> >
>> >> "Charles" <Charles@discussions.microsoft.com> wrote in message
>> >> news:8D6FA637-D29D-4F03-A43E-8FFB545CD4DC@microsoft.com...
>> >> > In a domain where there is a root domain and a few subdomains (may
>> >> > not
>> >> > make a
>> >> > difference) should the MaxPosPhaseCorrection and
>> >> > MaxNegPhaseCorrection
>> >> > values
>> >> > just need to be set on all domain controllers or all of the domain
>> >> > controllers including the servers and clients? Clients are XPsp2
>> >> > and
>> >> > servers
>> >> > are all W2k3sp2.
>> >> >
>> >> > Thanks,
>> >> > Chuck
>> >>
>> >>
>> >> As others mentioned, too much work and changes to something that works
>> >> perfectly by default. Let the domain hierarchy work, I've never had
>> >> any
>> >> trouble with it, including when I worked at a 5000 user system with
>> >> mutiple
>> >> child domains and AD global sites.
>> >>
>> >> --
>> >> Ace
>> >>
>> >> This posting is provided "AS-IS" with no warranties or guarantees and
>> >> confers no rights.
>> >>
>> >> Please reply back to the newsgroup or forum for collaboration benefit
>> >> among
>> >> responding engineers, and to help others benefit from your resolution.
>> >>
>> >> Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
>> >> Microsoft Certified Trainer
>> >>
>> >> For urgent issues, please contact Microsoft PSS directly. Please check
>> >> http://support.microsoft.com for regional support phone numbers.
>> >>
>> >>
>>
>>
>>
Previous Topic:Password Changes
Next Topic:AD Sites and Services Best Practices
Goto Forum:
  


Current Time: Wed Jan 17 05:50:20 MST 2018

Total time taken to generate the page: 0.02206 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software