Domain Controller Time Sync

  • Thread starter Thread starter FFF
  • Start date Start date
F

FFF

Hi All!

More strangeness in my domain is happening:

The Win2k logon to all PCs INCLUDING the domain controller fails with error:

Time out of sync between the server and client.

After logging to a workstation on as local admin, I run:

net time /domain:mydomain.com /set

but get access denied.

Strangely enough, everything works for a period of time after each reboot of the
Domain Controller.

Here's what has changed prior to the problem:
A local Server running Exchange 2k was dcpromo'd to domain controller, has been
assigned Global Catalog Server and Operations Master role (PDC).

(This was done to allow for troubleshooting a stability issue on the previous
standalone Domain Controller in the domain)

any ideas anyone?

TIA very much!

florian
 
On the DC:
just once from the commandprompt:
net time /setsntp:time.nist.gov
net stop w32time
w32tm -once -v
net start w32time

On the W2K/XP-clients just once:
net time /setsntp:servername
w32tm -once -v

Marina
 
On the DC:
just once from the commandprompt:
net time /setsntp:time.nist.gov
net stop w32time
w32tm -once -v
net start w32time

On the W2K/XP-clients just once:
net time /setsntp:servername
w32tm -once -v
Click to expand...

thanks Marina,
Did that.

Time synched ok, time server specified ok, system time on DC ok.

However, I can't even logon into Windows on the Domain Controller (!), therefore
the time skew issue is not between machines but between Windows and the
authentication (Kerberos) time stamp.

BTW: the following commands on the clients returned "access denied" after some
time following each server reboot (they worked if executed right away):

net time \\domaincontrollernetbiosname /set or
net time /domain:mydomain /set

florian
 
Hi Florian,

Like I said, on the clients you just have to do the commandsjust once, for example when logged in as administrator.

The commands you're mentioning are used in a loginscript for
W9x/ME/NT4-clients.

Marina
 
The commands you're mentioning are used in a loginscript for
W9x/ME/NT4-clients.
Click to expand...

Really? I really don't know much about pre-win2k stuff.

What do you think disables the Windows login on the DC?

florian
 
Hi Florian,

Sorry, what do you mean?

Marina

FFF said:
Really? I really don't know much about pre-win2k stuff.

What do you think disables the Windows login on the DC?

florian
Click to expand...
 
Back
Top