- Designate Type of Windows Time Service
To keep accurate time,
Windows 2000 Server by default invokes upon startup the Windows Time service ("W32Time.dll").
On Windows 2000 Professional, stop W32time in Start | Settings | Control Panel | Administrative Tools | Services | Windows Time.
Alternately, to manually start it from a Command Prompt, Run:
net start w32time
Since W32Time is started by default, the expected response to the command above is:
The requested service has already been started.
More help is available by typing NET HELPMSG 2182.
W32Time is controlled by values set in registry subkey HKEY LOCAL MACHINE\ SYSTEM\ CurrentControlSet\ Services\ W32Time\ Parameters.
Windows 2000-based servers have a default "Type" REG_SZ value of "Nt5DS" for "Domain hierarchy based synchronization",
which means that when a Windows 2000 workstation starts up on a network (not local), the Net Logon service
looks for a domain controller that can authenticate and synchronize time
with a domain controller in its own domain.
This can also be done manually:
net time /domain /set
Current time at \\computer1 is 6/14/200x 3:24 AM
The command completed successfully.
The syntax of the net time program is not case sensitive:
net time /?
NET TIME
[\\computername | /DOMAIN[:domainname]
| /RTSDOMAIN[:domainname]] [/SET]
[\\computername] /QUERYSNTP
[\\computername] /SETSNTP[:ntp server list]
In turn, domain controllers in child domains synchronize their time with
the Forest Root (Parent) Domain controller.
The "Type" can be changed to "NoSync" for no synchronization if you are using a third-party time utility.
NET TIME has
limitations versus 3rd party utilities
such as
Greyware's $495 Domain Time server control panel applet, which runs as a background service with safeguards against flooding attacks.
The "Type" can be changed to "NTP" for time synchronization with an external time service using the "industry-standard"
March 1995 SNTP (Simple Network Time Protocol) [RFC 1769] (which obsoletes RFC 1361) and is obsoleted by
October 1996 SNTP version 4 [RFC 2030], all adaptations of the full
NTP version 3 [RFC 1305] maintained by ntp.org.
NTP aims for accuracy of +/- 10 ms.
The SNTP protocol aims to keep all clocks in the machines of an enterprise within 20 seconds of one another, and all clocks in a site within two seconds of one another. Is this enough for you? Maybe not.
NTP Time Server on Windows from Meinberg, German makers of NTP cards and devices,
provides on Windows machines the same NTP service that runs on Unix servers.
Its Monitor Windows GUI displays NTP related application log entries and
time skew on a graph.
- Designate a Public/External NTP Time Service
A machine would use external synchronization if it's a stand-alone machine
or if it's a domain's time service, which is by default the Forest Root (Parent) Domain controller (PDC emulator).
However, in a large forest, designate another domain controller to be the
Domain Time Server
for the entire forest.
Server clocks are synchronized to the “UTC”, which English speakers call the Coordinated Universal Time.
BTW, the letters of this acronym is purposely jumbled from its acronymn
due to a compromise between the English "CUT" and French acronym
"TUC" for the same concept.
This accord was reached in 1970 by the International Telecommunication Union (ITU) of technical experts from around the world
who sought a replacement for "Greenwich Mean Time" near
London, England. UTC standard time is independent of time zones.
Note that Windows 2000 only recognizes the first DNS or IP address in the "ntp server list".
To set the "NtpServer" REG_SZ value in the W32Time\Parameters registry subkey, run one of these:
NET TIME \\%COMPUTERNAME% /SETSNTP:ntp-ucla.usno.navy.mil
NET TIME \\%COMPUTERNAME% /setsntp:ntp2.usno.navy.mil
The expected response is
The command completed successfully.
If you get an "Access Denied" message,
make sure you have Administrator rights to start and stop services.
If you get message "Could not locate a time server"
make sure that your firewall allows UDP port 123, which Windows external time services use by default.
Some companies reroute the Windows default time.windows.com domain to an internal server.
To confirm the SNTP value:
NET TIME /querysntp
- Setup Domain Time Server
Designate a computer to be the time server computer by using RegEdit to navigate to the HKEY LOCAL MACHINE \SYSTEM \CurrentControlSet \Services \W32Time \Parameters subkey
and changing the “LocalNTP” REG_DWORD value from 0 to 1.
To verify that the time service is synchronizing time,
use a tool installed by default in the WINNT/System32 folder:
- Adjust Kerberos default time skew for network speed and security
Unlike NT, Windows 2000 domain controllers need to have their time closely synchronized for
Kerberos
, which exchanges time-stamped authenticator identification tokens.
This is also true for OpenSSL and all encryption methods which are based on time.
If the server is on a slow network, you may receive this message:
KRB_AP_ERR_SKEW 0x25 "Clock skew too great"
Clock Skew is the range of time allowed for a server to accept Keberos authenticators from a client.
The default is 5 minutes. Longer time skews allow time for the Net Logon service to perform authentication over slow networks.
Even though logon passwords travel over the secure encrypted Net Logon Secure Channel, a discreet communication channel,
you may shorten time skews for better protection from replay attacks where
"hijackers" intercept communications between a client and a server and
replay them to gain access to network resources.
To change the Kerberos time skew on the server,
- From the Start menu, point to Settings, click Control Panel, double-click Administrative Tools, and then double-click Domain Security Policy.
- Expand Security Settings, Account Policies, and Kerberos Policy.
- Right-click Maximum tolerance for computer clock synchronization.
- Click Security.
- In the Security Policy dialog box, change the maximum tolerance variable.
W32Time uses the client's secure account password to generate a signature on SNTP packets that are
sent across the network. These contain a signed 64-bit hash of the time information.
- Flag a Domain Controller as a Reliable Time Source
Once a domain controller is known to keep accurate time, use RegEdit to
mark the computer as reliable by navigating to HKEY LOCAL MACHINE \SYSTEM \CurrentControlSet \Services \W32Time \Parameters subkey
and changing the "ReliableTimeSource" REG_DWORD to value "1".
The Net Logon service should now announce that the computer is a reliable time source when it logs on to the network.
- Synchronize Client Time
To manually force re-synchronization from a Command Prompt: use W32Time, which
has an evolving set of command syntax:
The program issues Sending resync command to local computer...
A zero return value means that the command was sent successfully --
not necessarily completed successfully.
Unlike NTP, SNTP uses connectionless
UDP, which doesn't guarantee delivery.
By default Windows 2000 machines perform a synchronization once every 45 minutes until successful three times, then once every eight hours (three times per day)
This "SpecialSkew" specification can be changed in the registry.
This keeps "loose synchronization" among all clocks in a network.
Differences of less than 55 ms do not trigger a time update.
No PDC?
PDC's which do not have an Active Directory server
can use
freeware such as
Dimension 4,
Webtime, or other
Winsock32 SNTP clients.
Atomtime.
|
|
Microsoft Articles:
-
How to Configure an Authoritative Time Server in Windows 2000
-
Basic Operation of the Windows Time Service
-
Windows 2000 Utilities: Taming the Time Service
-
Registry Entries for the W32 Time Service
-
The Windows 2000 Time Service
Universal Coordinated Time
UTC is obtained from a
Stratum 2 NTP time server which in turn sets itself to a trusted source (stratum 1 server) such as the
US Naval Observatory's Atomic Clock time server (tick.usno.navy.mil) in Washington, DC, which maintains the
official US Standard Time.
NIST, the National Institute of Standards and Technology, located in Boulder, Colorado,
provides the Automated Computer Time Service (ACTS), which can set a computer clock with an uncertainty of
less than 10 milliseconds.
Many sites at various time zones throughout the world offer time synchronization services.
Time Sync Software
Comparison of the $495 Greyware utility vs. Microsoft's W32Time and others:
NetTime from Sourceforge
$19.95 Altrixsoft Chronograph software synchronizes your local PC time using the Internet time service.
Clock display programs such as the
$9.95 WorldTimer (30 day nagware) use SNTP to set their time.
$13 JCOM Clock Synchronizer
Time Related Websites
- www.ubr.com/clocks
Everything you ever wanted to know about clock history, clock making, sundials, time standards, and other topics. Links to websites for time-related newsgroups, museums, books, Ezines, and more.
- www.calendarzone.com
A feast of celestial, cultural, historical, geographical, religious, and interactive calendar-related information. Y2K and millennium discussions plus calendar software and reference links.
- www.earthcalendar.net
A second calendar marvel. Lunar phase information, holidays sorted by religion and country worldwide. Links to related sites.
- tycho.usno.navy.mil/time.html
Time service of the United States Naval Observatory, Washington, D.C. Click for universal time, US time zones, where to see the first sunrise of the third millennium, and other information. Links to astronomical information.
- www.studyoftime.org
Website for the International Society for the Study of Time. Information on the history and goals of this interdisciplinary society, publications, and conferences.
- www.lindahall.org/ pubserv/ hos/ Y1K/ index
Online exhibition of science and technology in the year 1000 (Y1K). Also examines developments in medicine, astronomy, algebra, alchemy, and horticulture that grew out of the fertile intellectual climate surrounding the first millennium. Service of the Linda Hall Library of Science, Engineering, and Technology, Kansas City, Missouri.
- www.wnet.org/ archive/ tenement/ floorboards.html
Website for the Lower East Side Tenement Museum in New York. Peel back layers of wallpaper and lift floorboards to discover objects found in this tenement turned archaeological site turned museum. Boarded up from 1935-1987, the building is a living time capsule.
Dollhouse dioramas, photographs, history, and more.
- aic.stanford.edu
The American Institute for Conservation of Historic and Artistic Works. It provides a wealth of information regarding the preservation
and conservation of objects in time. Includes links to related sites.
- www.cam.net.uk/ home/ pb/ index.html
A brief history of 24-hour time, otherwise known as military, railroad, or navigational
time. Links to sources for 24-hour clocks.
|
|
|