How to Set Accurate Time for Windows Server 2016

Accurate Time For Windows Server 2016

It is important for Windows Server 2016 to maintain an accuracy of 1ms in sync with the UTC time. This is because new algorithms and periodic time checks are obtained from a valid UTC server.

The Windows time service is a component that uses a plugin for the client and server for synchronization.

Windows has two built-in client time providers that link with the third party plugins.

One of the providers uses the Network Time Protocol (NTP) or the Microsoft Network Time Protocol (MS-NTP) to manage the synchronizations to the nearest server.

Windows has a habit of picking the best provider if the two are available.

This article will discuss the three main elements that relate to an accurate time system in Windows Server 2016:

• Measurements
• Improvements
• Best practices

Domain Hierarchy

Computers that are members of a domain use the NTP protocol that authenticates to a time reference in relating to security and authenticity.

The domain computers synchronize with the master clock that is controlled by domain hierarchy and the scoring system.

A typical domain has hierarchical stratum layers where each Domain Controller (DC) refers to the parent DC with accurate time.

The hierarchy revolves around the Primary Domain Controller (PDC) or a DC with the root forest, or a DC with a Good Time Server for the Domain (GTIMESERV) flag.

Standalone computers use the time.windows.com service. The name resolution takes place when the Domain Name Service resolves to a time owned by a Microsoft resource.

Like any other remotely located time references, network outages do not allow synchronization to take place. Paths that are not symmetrical in a network reduce time accuracy.

Hyper-V guests have at least two windows time providers; therefore, it is possible to observe different behaviors with either the domain or the standalone.

NOTE: stratum refers to a concept in both the NTP and the Hyper-V providers. Each has a value indicating clock location in the hierarchy. Stratum 1 is for high-level clock, and stratum 0 is for hardware. Stratum 2 servers communicate to stratum 1 servers, stratum 3 to stratum 2, and the cycle continues. The lower strata show clocks that are more accurate with the possibility of finding errors. The command line tool w32tm (W32time) takes time from stratum 15 and below.

Factors Critical For Accurate Time

1. Solid Source Clock

The original source of the clock needs to be stable and accurate at all times. This implies that during the installation of the Global Positioning Service (GPS) pointing to stratum 1, you should take #3 into consideration.

Therefore, if the source clock shows stability, then the entire configuration will have a constant time.

Securing the original source time means that a malicious person will not be able to expose the domain to time-based threats.

2. Stable Client Clock

A stable client takes the natural drift of the oscillator to make sure that it is containable. The NTP uses multiple samples to condition the local clocks on standalone to stay on course.

If the time oscillation on the client computers is not stable, there will be fluctuations between adjustments leading to malfunctioning of the clock.

Some machines may require hardware updates for proper functioning.

3. Symmetrical NTP Communication

The NTP connection should be symmetrical at all times because the NTP uses calculation adjustments to set time as per the symmetry levels.

If the NTP request takes longer than the expected time on its return, time accuracy is affected. You may note that the path could change due to changes in topology or routing of packets through different interfaces.

The battery-powered devices may use different strategies, which in some cases require that the device be updating every second.

Such a setting consumes more power and can interfere with power saving modes. Some battery run devices have some power settings that can interfere with the running of other applications and hence interfere with the W32time functions.

Mobile devices are never 100% accurate, especially if you look at the various environmental factors that interfere with the clock accuracy. Therefore, battery-operated devices should not have high time accuracy settings.

Why is Time Important

A typical case in a Windows environment is the operation of the Kerberos that needs at least 5 minutes accuracy between the clients and servers.

Other instances that require time include:

• Government regulations, for example, the United States of America uses 50ms for FINRA, and the EU uses 1ms ESMA or MiFID II.
• Cryptography
• Distributed systems like the databases
• Block chain framework for bitcoin
• Distributed logs and threat analysis
• AD replication
• The Payment Card Industry (PCI)
• The Time Improvements for Windows Server 2016
• Windows Time Service and NTP

The algorithm used in Windows Server 2016 has greatly improved the local clock when synchronizing with the UTC. The NTP has four values to calculate the time offset based on timestamps of client requests or responses and server requests and responses.

The modern network environment has too much congestion and related factors that affect the free flow of communication.

Windows Server 2016 uses different algorithms to cancel out the disturbances. Besides, the source used in Windows for time references uses improved Application Programming Interface (API) with the best time resolution, giving an accuracy of 1ms.

Hyper-V

Windows 2016 Server made some improvements that include accurate VM start and VM restore. The change gives us an accuracy of 10µs of the host with a root mean square (RMS) of 50µs for a machine carrying a 75% load.

Moreover, the stratum level at the host sends to guests more transparently. Earlier hosts would be fixed at stratum 2, regardless of its accuracy and the changes in Windows Server 2016 the host reports at stratum 1, which gives better timing for the virtual machines.

Domains created in Windows 2016 Server will find time to be more accurate because the time does not default to the host and that is the reason behind manually disabling the Hyper-V time provider settings in Windows joining a Windows 2012R2 and below.

Monitoring

Counters tracking the performance counters are now part of the Windows Server 2016, they allow for monitoring, troubleshooting, and baselining time accuracy.

The counters include:

a. Computed Time Offset

This feature indicates the absolute time between the system clock and the chosen time source in microseconds. The time updates whenever a new valid sample is available. Clock accuracy is traced using the performance counter that has an interval of 256 seconds or less.

b. Clock Frequency Adjustment

This adjustment indicates the time set by the local W32Time measured in parts per billion. The counter is important when it comes to visualizing actions taken by W32time.

c. NTP Roundtrip Delay

NTP Roundtrip Delay is the time taken during the transmission of a request to the NTP server and when the response is valid.

This counter helps in characterizing the delays experienced by the NTP client. If the roundtrip is large or varies, it can lead to noise, especially when the NTP computes time, thereby affecting time accuracy.

d. NTP Client Source Count

The source count parameter holds the number of clients and unique IP addresses of servers that are responding to client requests. The number may be large or small compared to active peers.

e. NTP Server Incoming Requests

A representation of the number of requests received by the NTP server indicated as request per second.

f. NTP Server Outgoing Responses

A representation of the number of answered requests by the NTP server indicated as responses per second.

The first three show the target scenarios for troubleshooting accuracy issues. The last three cover NTP server scenarios, which help to determine the load and setting a base for the current performance.

Configuration Updates per Environment

The following is a description that changes the default configurations between Windows 2016 and earlier versions.

The settings for Windows Server 2016 and Windows 10 build 14393 are now taking unique settings.

Role	Settings	Server 2016	Windows 10	Servers 12 and 08 and Windows 10
Standalone or a Nano Server
	Time server	time.windows.com	N/a	time.windows.com
	Poling frequency	64-1024 seconds	N/a	Once a week
	Clock update frequency	Once a second	N/a	Once a hour
Standalone Client
	Time server	N/a	time.windows.com	time.windows.com
	Polling frequency	N/a	Once a day	Once a week
	Clock update frequency	N/a	Once a day	Once a week
Domain Controller
	Time server	PDC/GTIMESERV	N/a	PDC/GTIMESERV
	Polling frequency	64 to 1024 seconds	N/a	1024 to 32768 seconds
	Clock update frequency	Once a day	N/a	Once a week
Domain Member Server
	Time server	DC	N/a	DC
	Polling frequency	64 to 1024 seconds	N/a	1024 to 32768 seconds
	Clock update frequency	Once a second	N/a	Once every 5 minutes
Domain Member Client
	Time server	N/a	DC	DC
	Polling frequency	N/a	1024 to 32768 seconds	1024 to 32768 seconds
	Clock update frequency	N/a	Once every 5 minutes	Once every 5 minutes
Hyper-V Guest
	Time server	Chooses the best alternative based on host stratum and time on the server	Chooses the best alternative based on host stratum and time server	Defaults to host
	Polling frequency	Based on the role above	Based on the role above	Based on the role above
	Clock update frequency	Based on the role above	Based on the role above	Based on the role above

Impact of Increased Polling and Clock Update Frequency

To get the most accurate time, the defaults for polling frequencies and clock updates will give you the ability to make adjustments more frequently.

The adjustments lead to more UDP and NTP traffic that will in no way affect the broadband links.

Battery devices do not store the time when turned off, and when turned on, it may lead to frequent time adjustments. Increasing the polling frequency will lead to instability, and the device will use more power.

Domain controllers should have less interference after multiple effects of increasing updates from NTP clients and AD domain. NTP does not require many resources compared to other protocols.

You can reach the limits of the domain functionality before getting a warning, indicating increased settings in Windows Server 2016.

The AD does not use secure NTP, which does not synchronize time accurately but will increase the clients two strata away from the PDC.

You can reserve at least 100NTP requests per second for every core. If you have a domain with 4 CPUs each, the total NTP should be serving 1,600 NTP requests per second.

As you set up the recommendations, ensure you have a large dependency on the processor speeds and loads. Administrators should conduct all baseline tests onsite.

If your DCs are running on sizeable CPU load of more than 40%, the system is likely to generate some noise when NTP is responding to requests, which may impair domain time accuracy.

Time Accuracy Measurements

Methodology

Different tools can be used to gauge the time and accuracy of Windows Server 2016.

The techniques are applicable when taking measurements and tuning the environment to determine if the test outcome meet the set requirements.

The domain source clock has two precision NTP servers and GPS hardware.

Some of these tests need a highly accurate and reliable clock source as a reference point adding to your domain clock source.

Here are four different methods for measuring accuracy in physical and virtual machines:

• Take the reading of the local clock conditioned by a w32tm and reference it against a test machine with a separate GPS hardware.
• Measure pings coming from the NTP server to its clients using the “stripchart” of the W32tm utility
• Measure pings from the client to the NTP server using “stripchart” of the W32tm utility.
• Measure the Hyper-V output from the host to the guests using the Time Stamp Counter (TSC). After getting the difference of the host and client time in the VM, use the TSC to estimate the host time from the guest. We also consider the use of TSV clock to factor out delays and the API latency.

Topology

For comparison purposes, testing both the Windows Server 2012R2 and Windows Server 2016 based on topology is sensible.

The topologies have two physical Hyper-V hosts that point to a 2016 Server with a GPS hardware installed. Each of these hosts runs at least three domains joining the Windows guests, taking the arrangement shown in the diagrams below.

TOPOLOGY 1. Image Source

The lines on the diagram indicate time hierarchy and the transport or protocol used.

TOPOLOGY 2. Image Source

Graphical Results Overview

The following graph is a representation of the time accuracy between two members of a domain. Every graph shows both Windows Server 2012R2 and 2016 outcome.

The accuracy was a measurement taken from the guest machine in comparison to the host. The graphical data shown indicate both the best and worst case scenarios.

TOPOLOGY 3. Image Source

Performance of the Root Domain PDC

The root PDC synchronizes with the Hyper-V host using a VMIC that is present in Windows Server 2016 GPS hardware, which shows stability and accuracy. This is critical because a 1ms accuracy is needed.

Performance of the Child Domain Client

The child domain client is attached to a Child Domain PDC for sending communication to the Root PDC. Its timing should also be within the 1ms accuracy.

Long Distance Test

Long distance test could involve comparing a single virtual network hop to 6 physical network hops on Windows Server 2016.

Increasing network hops mean increasing latency and extending time differences. The 1ms accuracy may negatively change, which demonstrates a symmetrical network.

Do not forget that every network is different and measurements taken depend on varying environmental factors.

Best Practices for Accurate Timekeeping

1. Solid Source Clock

The machine timing is as good as its source clock. To achieve the 1ms accuracy, a GPS hardware or time appliance should be installed to refer to the master source clock.

The default time.windows.com may not give an accurate or stable local time source. Also, as you move away from the source clock, you are bound to lose time.

2. Hardware GPS Options

The different hardware solutions that offer accurate time depend on GPS antennas. Use of radio and dial-up modem solutions is also accepted. The hardware options connect through PCIe or USB ports.

Different options give varying time accuracy and the final time depends on the environment.

Environmental factors that interfere with accuracy depends on GPS availability, network stability, the PC hardware and network load.

3. Domain and Time Synchronization

Computers in a domain use the domain hierarchy to determine the machine to be used as a source for time synchronization.

Every domain member will look for a machine to sync with and save it as its source. Every domain member will follow a different route that leads to its source time. The PDC in the Forest Root should be the default source clock for all machines in the domain.

Here is a list of how roles in the domain find their original time source.

• Domain Controller with PDC role

This is the machine with authority on time source for the domain. Most of the time, its issues are accurate and must synchronize with the DC in the parent domain–with exceptional cases where GTIMESERV role is active.

• Other Domain Controller

This will take the role of a time source for clients and member servers in the domain. A DC synchronizes with the PDC of its domain or any DC in the parent domain.

• Clients or Member Servers

This type of machine will synchronize with any DC or PDC within its domain or picks any DC or PDC in the parent domain.

When sourcing for the original clock, the scoring system is used to identify the best time source. Scoring takes into account the reliable time source based on the relative location, which happens only once when the time service starts.

To fine-tune time synchronization, add good timeservers in a specific location and avoid redundancy.

Mixed Operating System Environments (Windows 2012 R2 and Windows 2008 R2)

In a pure Windows Server 2016 domain environment, you need to have the best time accuracy.

Deploying a Windows Server 2016 Hyper-V in a Windows 2012 domain will be more beneficial to the guests because of the improvements made in Server 2016.

A Windows Server 2016 PDC delivers accurate time due to the positive changes to its algorithms, which also acts as a credible source.

You may not have an option of replacing the PDC, but you can add a Windows Server 2016 DC with the GTIMESERV flag as one way of upgrading time accurately for the domain.

Windows Server 2016 DC delivers better time to lower clients, but it’s always good to use it as a source NTP time.

As already stated above, clock polling and refresh frequencies are modified in Windows Server 2016.

You can also change the settings manually to match the down-level DCs or make the changes using the group policy.

Versions that came prior to Windows Server 2016 have a problem with keeping accurate time since their systems drift immediately you make a change.

Obtaining samples from accurate NTP sources and conditioning the clock leads to small changes in system clock, ensuring better time keeping on the low-level OS versions.

In some cases involving the guest domain controllers, samples from the Hyper-V TimeSync is capable of disrupting time synchronization. However, for Server 2016, it should no longer be an issue when the guest machines run on Server 2016 Hyper-V hosts.

You can use the following registry keys to disable the Hyper-V TimeSync service from giving samples to w32time:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider

“Enabled”=dword:00000000

Allow Linux to Use Hyper-V Host Time

For guest machines using Linux and run the Hyper-V, it is normal for clients to use the NTP Daemon for time synchronization against the NTP servers.

If the Linux distribution supports version 4 TimeSync protocol with an enabled TimeSync integration on the guest, then synchronization will take place against the host time. Enabling both methods will lead to inconsistency.

Administrators are advised to synchronize against the host time by disabling the NTP time synchronization by using any of the following methods:

• Disabling NTP servers in the ntp.conf file
• Disabling the NTP Daemon

In this particular configuration, the Time Server Parameter is usually the host, and it should poll at a frequency of 5 seconds, which is the same as the Clock Update Frequency.

Exclusive synchronization over NTP demands that you disable the TimeSync integration service in the guest machine.

NOTE: Linux accurate timing support must have a feature supported in the latest upstream Linux Kernels. As at now, it is not available across most Linux distros.

Specify Local Reliable Time Service Using the GTIMESERV

The GTIMESERV allows you to specify one or more domain controllers as the accurate source clocks.

For example, you can use a specific domain controller with a GPS hardware and flag it as GTIMESERV to make sure that your domain references to a clock based on a GPS hardware.

TIMESERV is a Domain Services Flag that indicates whether the machine is authoritative and can be changed if the DC loses connection.

When the connection is lost, the DC returns the “Unknown Stratum” error when you query via the NTP. After several attempts, the DC will log System Event Time Service Event 36.

When configuring a DC as your GTIMESERV, use the following command:

w32tm /config /manualpeerlist:”master_clock1,0x8 master_clock2,0x8” /syncfromflags:manual /reliable:yes /update

If the DC has a GPS hardware, use the following steps to disable the NTP client and enable the NTP server:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\NtpClient /v Enabled /t REG_DWORD /d 0 /f

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\NtpServer /v Enabled /t REG_DWORD /d 1 /f

Then, restart Windows Time Service

net stop w32time && net start w32time

Finally, tell network hosts that this machine has a reliable time source using this command:

w32tm /config /reliable:yes /update

Confirm the changes, run the following commands, which indicate the results as shown:

w32tm /query /configuration

Value	Expected Setting
AnnounceFlags	5 (Local)
NtpServer	(Local)
DIIName	C:\WINDOWS\SYSTEM32\w32time.DLL (Local)
Enabled	1 (Local)
NtpClient	(Local)

w32tm /query /status /verbose

Value	Expected Setting
Stratum	1 (primary reference – syncd by radio clock)
ReferenceId	0x4C4F434C (source name: “LOCAL”)
Source	Local CMOS Clock
Phrase Offset	0.0000000s
Server Role	576 (Reliable Time Service)

Windows Server 2016 on 3rd party Virtual Platforms

The virtualization of Windows means that the time responsibility defaults to the Hypervisor.

However, new members of the domain need to be synchronized with the Domain Controller for the AD to work effectively. The best that you can do is to disable time virtualization between guests and 3rd party virtual platforms.

Discover the Hierarchy

The chain of time hierarchy to the master clock is dynamic and non-negotiated. You must query the status of a specific machine to get its time source. This analysis helps in troubleshooting issues relating to synchronizations.

If you are ready to troubleshoot, find the time source by using the w32tm command:

w32tm /query /status

The output will be the source. Finding the source is the initial step in time hierarchy.

The next thing to do is to use the source entry and /Stripchart parameter to find the next time source.

w32tm /stripchart /computer:MySourceEntry /packetinfo /samples:1

The command below gives a list of domain controllers found in a specific domain and relays the results that you can use to determine each partner. The command also includes machines with manual configurations.

w32tm /monitor /domain:my_domain

You can use the list to trace the results through the domain and know their hierarchy and time offset at each step.

If you mark the point where time offset increases, you can get to know the cause of incorrect time.

Using Group Policy

Group policy is used to accomplish strict accuracy by making sure clients are assigned specific NTP servers. Clients can control how down-level OS should work when virtualized.

Look at the following list of all possible scenarios and relevant Group Policy settings:

• Virtualized Domains

To gain control over the Virtualized Domain Controllers in Windows 2012 R2, disable the registry entry corresponding to the virtual domain controllers.

You may not want to disable the PDC entry because in most cases, Hyper-V host delivers a stable time source. The entry to the registry requires that you restart the w32time service after making changes.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider]

“Enabled”=dword:00000000

• Accuracy Sensitive Loads

For any workload that is sensitive to time accuracy, ensure that the group machines are set to use the NTP servers and any related time settings like update frequency and polling.

This is a task handled by a domain, but if you want to have more control, target specific machines to point to the master clock

Group Policy Setting	New Value
NtpServer	ClockMasterName,0x8
MinPollInterval	6-64 seconds
MaxPollInterval	6 seconds
UpdateInterval	100 to once per second
EventLogFlags	3 – All special time logging

NOTE: The NtpServer and EventLogFlags are located on the System\Windows Time Service\Time Providers, if you follow the Configure Windows NTP Client Settings. The other three are under the System\Windows Time Service, if you follow the Global Configuration Settings

Remote Accuracy Sensitive Loads Remote

For systems running on the branch domains, such as the Retail and Payment Credit Industry (PCI), Windows will use the current site data and DC Locator to search the local DC, unless you have a manual NTP time source configured.

In such an environment, you need 1 second accuracy with the option of using the w32time services to move the clock backwards.

If you can meet the requirements, use the table below to create a policy.

Group Policy Settings	New Value
MaxAllowedPhaseOffset	1, if more than on second, set clock to correct time.

The MaxAllowedPhaseOffset is a setting you will find under System\Windows Time Service using global Configuration settings.

Azure and Windows IaaS Consideration

• Azure Virtual Machine: Active Directory Domain Services

If you have Azure VM running Active Directory Domain Services as part of the existing configuration in a Domain Forest, then the TimeSync (VMIC) should not be running.

Disabling VMIC allows all DCs in both physical and virtual forests to use a single time sync hierarchy.

• Azure Virtual Machine: Domain –Joined Machine

If you have a host whose domain links to an existing Active Directory Forest, whether virtual or physical, the best you can do is to disable TimeSync for the guest and make sure the W32Time is set to synchronize with the Domain Controller.

• Azure Virtual Machine: Standalone Workgroup Machine

If your Azure is not part of a domain and it is not a Domain Controller, you can keep the default time configuration and let the VM synchronize with the host.

Windows Applications that Require Accurate Time

Stamp API

Programs or applications that need time accuracy in line with the UTC should use the GetSystemTimePreciseAsFileTime API to get the time as defined by Windows Time Service.

UDP Performance

An application that uses UDP to communicate during network transactions should minimize latency. You have the registry options to use when configuring different ports. Note that any changes to the registry should be restricted to system administrators.

Windows Server 2012 and Windows Server 2008 need a Hotfix to avoid datagram losses.

Update Network Drivers

Some network cards have updates that help improve performance and buffering of UDP packets.

Logging for System Auditors

Time tracing regulation may force you to comply by archiving the w32tm logs, performance monitors, and event logs. Later, these records may be used to confirm your compliance at a specific time in the past.

You can use the following to indicate time accuracy:

• Clock accuracy using the computed time offset counter
• Clock source looking for “peer response from” in the w32tm event logs
• Clock condition status using the w32tm logs to validate the occurrence of “ClockDispl Discipline:*SKEW*TIME*.”

Event Logging

An event log can give you a complete story in the information it stores. If you filter out the Time-Server logs, you will discover the influences that have changed the time. Group policy can affect the events of the logs.

W32time Debug Logging

Use the command utility w32tm to enable audit logs. The logs will show clock updates as well as the source clock.

Restarting the service enables new logging.

Performance Monitor

The Windows Server 2016 Time service counters can collect the logging information that auditor’s need. You can log the data locally or remotely by recording the machine’s Time Offset and Round Trip Delays.

Like any other counter, you can create remote monitors and alerts using the System Center Operations Manager. You can set an alert for any change of accuracy when it happens.

Windows Traceability Example

Using sample log files from the w32tm utility, you can validate two pieces of information where the Windows Time Service conditions the first log file at a given time.

151802 20:18:32.9821765s – ClockDispln Discipline: *SKEW*TIME* – PhCRR:223 CR:156250 UI:100 phcT:65 KPhO:14307

151802 20:18:33.9898460s – ClockDispln Discipline: *SKEW*TIME* – PhCRR:1 CR:156250 UI:100 phcT:64 KPhO:41

151802 20:18:44.1090410s – ClockDispln Discipline: *SKEW*TIME* – PhCRR:1 CR:156250 UI:100 phcT:65 KPhO:38

All the messages that start with “ClockDisplin Discipline” are enough proof that your system is interacting with the system clock via the w32time.

The next step is to find the last report before the time change to get the source computer that is the current reference clock.

Like in the example below, we have the Ipv4 address of 10.197.216.105 as the reference clock. Another reference could point to the computer name or the VMIC provider.

151802 20:18:54.6531515s – Response from peer 10.197.216.105,0×8 (ntp.m|0x8|0.0.0.0:123->10.197.216.105:123), ofs: +00.0012218s

Now that the first section is valid, investigate the log file on the reference time source using the same steps.

This will give you a physical clock such as the GPS or a known time source like the National Institute of Standards and Technology (NIST). If the clock is a GPS hardware, then manufacturer logs may be required.

Network Considerations

The NTP protocol algorithm depends on the network symmetry, making it difficult to predict the type of accuracies needed for certain environments.

You an use the Performance Monitor and new Windows Time Counters for Windows Server 2016 to create baselines.

The Precision Time Protocol (PTP) and the Network Time Protocol (NTP) are the two that you can use to gauge accurate time.

If clients are not part of a domain, Windows use the Simple NTP by default. Clients found within a Windows domain use the secure NTP protocol, also referred to as MS-SNTP, which help in leveraging domain communication, consequently giving an advantage over Authenticated NTP.

Reliable Hardware Clock (RTC)

Windows will not step time unless some conditions are beyond the norm. The implication is that the w32tm changes the frequency at regular intervals while relying on the Clock Update Frequency Settings, which is 1 second on Windows Server 2016.

It will move the frequency if it is behind, and vice versa when it is ahead of time.

This reason explains why you need to have acceptable results during the baseline test. If what you get for the “Computed Time Offset” is not stable, then you may have to verify the status of the firmware.

Troubleshooting Time Accuracy and NTP

The Discovering Hierarchy section gave us an understanding of the source and inaccurate time.

You need to look for time offset to identify the point where the divergence takes place from its NTP Sources. Once you can trace the hierarchy of time, you need to focus on the divergent system to gather more information in determining the issues causing all these inconsistencies.

Here are some tools that you can use:

System event logs

• Enable logging:

w32tm logs – w32tm /debug /enable /file:C:\Windows\Temp\w32time-test.log /size:10000000 /entries:0-300

w32Time Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time

• Local network interfaces
• Performance counters
• W32tm /stripchart /computer:UpstreamClockSource
• PING UpstreamClockSource (gauging latency and understanding the number of hops to source)

Tacert UpstreamClockSource

Problem	Symptoms	Resolution
Local TSC unstable	Use perfmon-Physical computer- Sync clock stable clock	Update firmware or try an alternative hard to confirm that it does display the same issue
Network latency	W32tm stripchart displays the RoundTripDelay exceeding 10ms. Use Tracert to find where the latency thrives	Locate a nearby source clock for time. Install a source clock on the same domain segment or point to one that is geographically closer. Domain environment needs a client with the GtimerServ role.
Unable to reliably reach the NTP source	W32tm /stripchart gives “request time out”	NTP source unresponsive
NTP Source is not responsive	Check Perfmon counters for NTP client Source Count, NTP server outgoing responses, and NTP Server Incoming Requests. Determine the outcome with your baseline tests results	Use server performance counters to determine change in load or if there is any network congestion
Domain Controller not using the most accurate clock	Changes in topology or a recently added master clock	w32tm /resync /rediscover
Clients Clocks are drifting	Time-Service event 36 in System event log or you see a text log with the following description: “NTP Client Time Source Count” going from 1 to 10	Identify errors in the upstream source and query if it may be experiencing performance issues

Baselining Time

Baseline tests are important because they give you an understanding of the expected performance accuracy of the network.

You can use the output to detect problems on your Windows Server 2016 in the future. The first thing to baseline is the root PDC or any machine with the role of GTIMESRV.

Every PDC in the forest should have a baseline test results. Eventually, you need to pick DCs that are critical and get their baseline results too.

It is important to baseline Windows 2016 and 2012 R2 using the w32tm /stripchart as a comparison tool. If you use two similar machines, you can compare their results and make comprehensive analysis.

Using the performance counters, you can collect all information for at least one week to give you enough references when accounting for various network time issues.

If you have more figures for comparison, you’ll gain enough confidence that your time accuracy is stable.

NTP Server Redundancy

A manual NTP server configuration in a non-domain network means that you should have a good redundancy measure to get better accuracy when other components are also stable.

On the other hand, if your topology does not have a good design and other resources are not stable, it’ll lead to poor accuracy levels. Take caution to limit timeservers’ w32time to 10.

Leap Seconds

The climatic and geological activities on planet earth lead to varying rotation periods. In an ideal scenario, the rotation varies every two years by one second.

When the atomic time grows, there will be a correction of a second up or down called the leap second. When doing the correction, it never exceeds 0.9 seconds. The correction is always announced six months before time.

Before Windows Server 2016, the Microsoft Time Service did not account for the leap seconds and relied on external time service to handle the adjustments.

The changes made to Windows Server 2016, Microsoft is working on a suitable solution to handle the leap second.

Secure Time Seeding

W32time in Windows Server 2016 includes the Secure Time Seeding Feature that determines the approximate current time of the outgoing Secure Sockets Layer Connection (SSL). The value helps in correcting gross errors on the local system clock.

You can decide not to use the Secure Time Seeding feature and use the default configurations, instead.

If you intend to disable the feature, use the following steps:

• Set the UtilizeSSLTimeData registry value to 0 using the command below:

reg add KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\Config /v UtilizeSslTimeData /t REG_DWORD /d 0 /f

• If the machine does not detect any changes and does not ask for a reboot, notify the W32time service about the changes. This will stop enforcing time monitoring based on data coming from the SSL connections.

W32tm.exe /config /update

• Rebooting the machine activates the settings immediately and directs the machine to stop collecting data from SSL connections.

For the above setting to be effective on the entire domain, set the UtilizeSSLTimeData value in W32time using the Group Policy Setting to 0, and make the setting public.

The moment the setting is picked by a Group Policy Client, the W32time service gets the notification and stops enforcing and monitoring SSL time data.

If the domain has some portable laptops or tablets, you can exclude them from the policy change because when they lose battery power, they will need to re-access the Secure Time Seeding feature to acquire the current time.

Conclusion

The latest developments in the world of Microsoft Windows Server 2016 means that you can now get the most accurate time on your network once you observe some conditions.

The Windows Time Service (W32Time) main work is to give your machine time, regardless of whether it is a standalone or part of a network environment.

The primary use of time in a Windows Server 2016 environment is to make sure that there is enough security for Kerberos authentication.

The W32Time makes it almost impossible to have replay attacks in an Active Directory or when running Virtual Machines on Hyper-V hosts.