0

I have an Active Directory domain, with a domain controller running on Samba on Linux.

I noticed that my Windows clients are having clock drift. I think this is because they really want the domain controller to offer a time synchronization service. But since I never set up a time server on the domain controller, that isn't happening.

Now, Samba doesn't seem to include a time server feature, and I would rather not add another service to the things I need to maintain. I am perfectly happy with everyone in the domain, including the DC, individually syncing up with time.windows.com. But if I go in the default domain policy or in gpedit.msc on an individual client and make the Configure Windows NTP Client and Enable Windows NTP Client objects, they don't seem to take effect, and my client's time source stays stuck at "Local CMOS Clock".

How can I configure Group Policy in an Active Directory domain to make clients get their time directly from an Internet NTP server, instead of from a domain controller?

I found this answer that gives a command line procedure that it claims lets you escape the domain time hierarchy for an individual host, but I am interested in doing it for all the clients in the domain (and also the DC, though that is Samba and unlikely to obey the policy).

interfect
  • 313
  • 1
  • 2
  • 7
  • 1
    https://theitbros.com/configure-ntp-time-sync-group-policy/ – joeqwerty Aug 03 '23 at 13:53
  • All domain controllers advertise as a time server by default. It doesn't need to be configured. If you want to know why it is using the local clock, you should enable time service verbose logging. – Greg Askew Aug 03 '23 at 14:32
  • @GregAskew Samba *advertises* as a time server, but doesn't actually *implement* an NTP daemon, so it does not actually synchronize time for clients out of the box. – interfect Aug 06 '23 at 01:09
  • @joeqwerty I attempted to follow the "Configure Client Time Sync Settings Using GPO" part of that page. It did not seem to work for me. – interfect Aug 06 '23 at 01:11
  • @interfect: domain controllers don't advertise as NTP servers by default. It uses RPC. 99.9999% of Windows clients use RPC for time synchronization by default. – Greg Askew Aug 06 '23 at 09:11

0 Answers0