Export (0) Print
Expand All
Expand Minimize

AD DS: The PDC emulator master in this forest should be configured to correctly synchronize time from a valid time source

Published: April 23, 2009

Updated: August 31, 2012

Applies To: Windows Server 2008 R2, Windows Server 2012

This topic is intended to address a specific issue identified by a Best Practices Analyzer scan. You should apply the information in this topic only to computers that have had the Active Directory Domain Services Best Practices Analyzer run against them and are experiencing the issue addressed by this topic. For more information about best practices and scans, see Best Practices Analyzer (http://go.microsoft.com/fwlink/?LinkId=122786).

 

Operating System

Windows Server 2008 R2

Windows Server 2012

Product/Feature

Active Directory Domain Services (AD DS)

Severity

Error

Category

Configuration

The primary domain controller (PDC) emulator operations master in this forest is not configured to correctly synchronize time from a valid time source.

The Windows Time Service tool (W32time) ensures that all the computers in an organization that are running Microsoft Windows operating systems (excluding operating systems earlier than Windows 2000) use a common time. By default, Windows-based computers use a hierarchy in which the domain controller that holds the primary domain controller (PDC) emulator operations master (also known as flexible single master operations or FSMO) role at the root of the forest becomes the authoritative time server for the network.

If the PDC emulator master in this forest is not configured to correctly synchronize time from a valid time source, it might use its internal clock for time synchronization. If the PDC emulator master in this forest fails or otherwise becomes unavailable (and if you have not configured a reliable time server (GTIMESERV) in the forest root domain), other member computers and domain controllers in the forest will not be able to synchronize their time.

Set the PDC emulator master in this forest to synchronize time with a reliable external time source. If you have not configured a reliable time server (GTIMESERV) in the forest root domain, set the PDC emulator master in this forest to synchronize time with a hardware clock that is installed on the network (the recommended approach). You can also set the PDC emulator master in this forest to synchronize time with an external time server by running the w32tm /config /computer:<<PDC-FQDN>> /manualpeerlist:time.windows.com /syncfromflags:manual /update command. If you have configured a reliable time server (GTIMESERV) in the forest root domain, set the PDC emulator master in this forest to synchronize time from the forest root domain hierarchy by running w32tm /config /computer:<<PDC-FQDN>> /syncfromflags:domhier /update.

To configure the PDC emulator master to synchronize time from a hardware clock device on the internal network, consult the instructions for the hardware clock device.

You can use the following procedure to configure the PDC emulator master to synchronize time in your forest.

Membership in Domain Admins, or equivalent, is the minimum required to complete this procedure remotely. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).

  1. Open a Command Prompt window as an administrator: On the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  2. Do one of the following:

    • If you have not configured a reliable time server (GTIMESERV) in the forest root domain, to configure the PDC emulator master to use a Network Time Protocol (NTP) time source, at the command prompt, type the following command, and then press ENTER:

      w32tm /config /computer:<<PDC-FQDN>> /manualpeerlist:time.windows.com /syncfromflags:manual /update 
      
      noteNote
      GTIMESERV is a netlogon flag that the Windows Time service uses. This flag indicates that the computer is a reliable time source. For more information about how to set a domain controller in your forest as a reliable time source, see Configure a domain controller in the parent domain as a reliable time source (http://go.microsoft.com/fwlink/?LinkId=148260).

    • If you have configured a reliable time server (GTIMESERV) in the forest root domain, to set the PDC emulator master in this forest to synchronize time from the forest root domain hierarchy, type the following command, and then press ENTER:

      w32tm /config /computer:<<PDC-FQDN>> /syncfromflags:domhier /update
      

     

    Parameter Description

    w32tm /config /update

    Configures the computer to synchronize time.

    /computer:<<PDC-FQDN>>

    Specifies the fully qualified domain name (FQDN) of the PDC for which you are configuring time synchronization.

    /manualpeerlist:time.windows.com

    Specifies that time.windows.com is the NTP time source with which this PDC emulator master is being configured to synchronize time.

    /syncfromflags:manual

    Specifies that time will be synchronized with peers in the manual peer list.

    /syncfromflags:domhier

    Specifies that time will be synchronized from the forest root domain hierarchy.

    For more information about the w32tm command, at a command prompt type w32tm /?, or see Windows Time Service Tools and Settings (http://go.microsoft.com/fwlink/?LinkId=112116).

For more information, see Configure the Time Source for the Forest (http://go.microsoft.com/fwlink/?LinkId=149595).

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft