[Samba] time sync for windows workstations

[Gregory Sloop]

mjhm> Hi all,

mjhm> On our DC's we use ntp to keep time synced. I've googled a bit on AD and
mjhm> time sync on workstations, and it seems they are supposed to sync their
mjhm> time with the time on the DC.

mjhm> I see however that in our network, this is not occuring: there is a 
mjhm> minute time difference between the dc's and my workstation.

mjhm> Is this something that samba has not yet implemented, or is there 
mjhm> something else wrong here? What are you observing in your networks?

mjhm> Regards,
mjhm> MJ

You have all the details correct - time sync on Windows stations joined to the domain should simply "work." [I'm not sure what will occur with non Windows workstations, but I think you're talking about Windows...]

On Windows workstations, there's no limit to clock adjust, as there is for Servers. [At least none I'm aware of.]

I also can't see any reason not to use pool.ntp.org as your time source. 
Frankly, as long as all the DC's are in close sync [with each other], it wouldn't *really* matter if time was, say, 42 minutes off of real time. It would certainly be confusing, but it shouldn't _cause_ a problem. And while running your own NTP-S1 source might be nice, grabbing from the wide pool certainly won't cause any problems that I'm aware of. [It certainly isn't the source of the issue you are having.]

If they're not syncing, I'm not sure what the issue would be, or where to look. Hopefully one of the experts will chime in on what to examine. In the interim, are there any firewall rules on the DC's that might be blocking communications that would handle time sync? 

This article describes how to set domain joined machines back to domain time sync:
http://technet.microsoft.com/en-us/library/cc758905%28v=ws.10%29.aspx 

But that would only apply if you'd modified it. And wouldn't explain how they're syncing a minute off, if they were syncing with some real-world NTP source. So, I doubt it's helpful, but a thought.

---
I see that "NET TIME /SET" at a commend line [on an affected Windows workstation] should generate a manual sync as well as tell you where it's going to sync from. This would be a good start.


HTH

-Greg