Replica DCs on Azure – Manage the Time Configuration settings on the DCs

1:46 pm in Azure, Cloud, DC, hybrid cloud, IaaS, PowerShell, Replica DC, Time Service, W2K12R2 by Wim Matthyssen

This blog post is part of the step-by-step to deploy replica domain controllers (DCs) on Microsoft Azure which can be found here: http://scug.be/wim/2015/09/28/deploying-replica-dcs-in-windows-azure/

Because time management is one of the most critical things to take care of in an AD domain, I will discuss this topic in this part of the series. Like you probably all know, all DCs should be in time synchronization with the DC holding the PDC Emulator role. This DC is responsible for the time in the AD environment. Therefore it’s a best practice to manually set this server to synchronize his time with an external time source on the Internet (time.windows.com, be.pool.ntp.org, us.pool.ntp.org, …). In their place all other DCs sync their time with the this PDC Emulator.

Other than the DCs, all member servers and workstations will sync time with their authenticated DC. Be aware that when the local time of a server or workstation is out of sync (more than 5 minutes – default setting) Kerberos authentication will fail and users won’t be able to login. Besides all that, time stamps are also used in AD replication process. Below I will list some commands you can run in PowerShell, which will manage the time configuration settings on the DCs. Some oh these commands can also be used on a member server or even on a workstation. I hope you have some time to go through it.

 

 

* Picture source: https://technet.microsoft.com/en-us/library/cc773013.aspx

Check and set the Time Zone on a DC (PowerShell):

1) Logon to one of the DCs, open PowerShell and check the Time Zone via following cmdlet:

clip_image003

2) To set the time zone, run following command:

clip_image005

Set the DC which holds the PDC Emulator role to synchronize time with an external time server (PowerShell):

1) To find the server who holds the PDC Emulator FSMO role run following PowerShell command:

clip_image007

2) Logon to the DC holding the PDC Emulator role (GR-DC-01), open PowerShell As an Administrator and run the below command to check the current time against an external time server (time.windows.com):

clip_image009

3) The following command needs to be run on the PDC Emulator (GR-DC-01). Logon to an Azure DC, open PowerShell as an Administrator and run the below command to set the current time in synchronization with an external time server (time.windows.com):

clip_image011

4) The following command needs to be run on the Azure IaaS DCs (or all other DCs not holding the PDC Emulator role). Logon to an Azure DC (AZGR-DC-01), open PowerShell as an Administrator and run the below command to set the current time in synchronization with the PDC Emulator (GR-DC-01):

clip_image013

5) To check if all if the time settings are applied correctly, open up PowerShell (as admin) again and run following command. If you run this on the PDC Emulator and on another DC, you should see different settings under [TimeProviders] if all is configured well:

clip_image015

clip_image017

This concludes this part of the series, but if you’re interested in reading more about the Windows Time Service you can do so via following Microsoft TechNet article: Windows Time Service Technical Reference

Till next time!

Wim Matthyssen (@wmatthyssen)