Skip to content

Commit ef8570c

Browse files
v-stsavellv-stsavell
authored
Merge pull request #207042 from NDVALPHA/NDVALPHA-ADDED-EXTERNAL-NTPSOURCE
NDVALPHA-ADDED-EXTERNAL-NTPSOURCE
2 parents b574637 + de8ced0 commit ef8570c

File tree

3 files changed

+89
-1
lines changed

3 files changed

+89
-1
lines changed

‎articles/virtual-machines/TOC.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -802,6 +802,9 @@
802802
- name: Windows
803803
displayName: Time sync
804804
href: ./windows/time-sync.md
805+
- name: Active Directory Windows Virtual Machines in Azure with External NTP Source
806+
displayName: Active Directory, Timesync, Windows, NTP
807+
href: ./windows/external-ntpsource-configuration.md
805808
- name: Run Command
806809
items:
807810
- name: Overview

‎articles/virtual-machines/windows/external-ntpsource-configuration.md

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
title: Active Directory Windows Virtual Machines in Azure with External NTP Source
3+
description: Active Directory Windows Virtual Machines in Azure with External NTP Source
4+
author: NDVALPHA
5+
ms.service: virtual-machines
6+
ms.collection: windows
7+
ms.topic: conceptual
8+
ms.workload: infrastructure-services
9+
ms.date: 08/05/2022
10+
ms.author: ndelvillar
11+
---
12+
13+
# Configure Active Directory Windows Virtual Machines in Azure with External NTP Source
14+
15+
**Applies to:** :heavy_check_mark: Windows Virtual Machines
16+
17+
Use this guide to learn how to setup time synchronization for your Azure Windows Virtual Machines that belong to an Active Directory Domain with an external NTP source.
18+
19+
## Time Sync for Active Directory Windows Virtual Machines in Azure with External NTP Source
20+
21+
Time synchronization in Active Directory should be managed by only allowing the PDC to access an external time source or NTP Server. All other Domain Controllers would then sync time against the PDC. If your PDC is an Azure Virtual Machine follow these steps:
22+
23+
>[!NOTE]
24+
>Due to Azure Security configurations, the following settings must be applied on the PDC using the **Local Group Policy Editor**.
25+
26+
To check current time source in your **PDC**, from an elevated command prompt run *w32tm /query /source* and note the output for later comparison.
27+
28+
1. From *Start* run *gpedit.msc*
29+
2. Navigate to the *Global Configuration Settings* policy under *Computer Configuration* -> *Administrative Templates* -> *System* -> *Windows Time Service*.
30+
3. Set it to *Enabled* and configure the *AnnounceFlags* parameter to **5**.
31+
4. Navigate to *Computer Settings* -> *Administrative Templates* -> *System* -> *Windows Time Service* -> *Time Providers*.
32+
5. Double click the *Configure Windows NTP Client* policy and set it to *Enabled*, configure the parameter *NTPServer* to point to an IP address of a time server followed by `,0x9` for example: `131.107.13.100,0x9` and configure *Type* to NTP. For all the other parameters you can use the default values, or use custom ones according to your corporate needs.
33+
34+
>[!IMPORTANT]
35+
>You must mark the VMIC provider as *Disabled* in the Local Registry. Remember that serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For how to back up and restore the Windows Registry follow the steps below.
36+
37+
## Back up the registry manually
38+
39+
- Select Start, type regedit.exe in the search box, and then press Enter. If you are prompted for an administrator password or for confirmation, type the password or provide confirmation.
40+
- In Registry Editor, locate and click the registry key or subkey that you want to back up.
41+
- Select File -> Export.
42+
- In the Export Registry File dialog box, select the location to which you want to save the backup copy, and then type a name for the backup file in the File name field.
43+
- Select Save.
44+
45+
## Restore a manual backup
46+
47+
- Select Start, type regedit.exe, and then press Enter. If you are prompted for an administrator password or for confirmation, type the password or provide confirmation.
48+
- In Registry Editor, click File -> Import.
49+
- In the Import Registry File dialog box, select the location to which you saved the backup copy, select the backup file, and then click Open.
50+
51+
To mark the VMIC provider as *Disabled* from *Start* type *regedit.exe* -> In the *Registry Editor* navigate to *HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders* -> On key *VMICTimeProvider* set the value to **0**
52+
53+
>[!NOTE]
54+
>It can take up to 15 minutes for these changes to reflect in the system.
55+
56+
From an elevated command prompt rerun *w32tm /query /source* and compare the output to the one you noted at the beginning of the configuration. Now it will be set to the NTP Server you chose.
57+
58+
## GPO for Clients
59+
60+
Configure the following Group Policy Object to enable your clients to synchronize time with any Domain Controller in your Domain:
61+
62+
To check current time source in your client, from an elevated command prompt run *w32tm /query /source* and note the output for later comparison.
63+
64+
1. From a Domain Controller go to *Start* run *gpmc.msc*
65+
2. Browse to the Forest and Domain where you want to create the GPO.
66+
3. Create a new GPO, for example *Clients Time Sync*, in the container *Group Policy Objects*.
67+
4. Right-click on the newly created GPO and Edit.
68+
5. In the *Group Policy Management Editor* navigate to the *Configure Windows NTP Client* policy under *Computer Configuration* -> *Administrative Templates* -> *System* -> *Windows Time Service* -> *Time Providers*
69+
6. Set it to *Enabled*, configure the parameter *NTPServer* to point to a Domain Controller in your Domain followed by `,0x8` for example: `DC1.contoso.com,0x8` and configure *Type* to NT5DS. For all the other parameters you can use the default values, or use custom ones according to your corporate needs.
70+
7. Link the GPO to the Organizational Unit where your clients are located.
71+
72+
>[!IMPORTANT]
73+
>In the the parameter `NTPServer` you can specify a list with all the Domain Controllers in your domain, like this: `DC1.contoso.com,0x8 DC2.contoso.com,0x8 DC3.contoso.com,0x8`
74+
75+
From an elevated command prompt rerun *w32tm /query /source* and compare the output to the one you noted at the beginning of the configuration. Now it will be set to the Domain Controller that satisfied the client's authentication request.
76+
77+
## Next steps
78+
79+
Below are links to more details about the time sync:
80+
81+
- [Windows Time Service Tools and Settings](/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings)
82+
- [Windows Server 2016 Improvements
83+
](/windows-server/networking/windows-time-service/windows-server-2016-improvements)
84+
- [Accurate Time for Windows Server 2016](/windows-server/networking/windows-time-service/accurate-time)
85+
- [Support boundary to configure the Windows Time service for high-accuracy environments](/windows-server/networking/windows-time-service/support-boundary)

‎articles/virtual-machines/windows/time-sync.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ There are three options for configuring time sync for your Windows VMs hosted in
4848

4949
- Host time and time.windows.com. This is the default configuration used in Azure Marketplace images.
5050
- Host-only.
51-
- Use another, external time server with or without using host time.
51+
- Use another, external time server with or without using host time. For this option follow the [Configure Azure Windows VMs with External NTP Source](external-ntpsource-configuration.md) guide.
5252

5353

5454
### Use the default

0 commit comments

Comments
 (0)