NTPServer<\/strong>: Multiple (a pool) of NTP servers can be added by separating them with a space. This setting is used only when Type is set to NTP or AllSync. Additional options can be added to the end of each NTP server in the form of hex codes related to the associating mode it will run in.<\/p>\n These values can be combined. For Example: 0x09 means SpecialInterval and NTP request in Client mode.<\/p>\n Most environments will typically use option 0x08.<\/em><\/p>\n Type<\/strong>: Indicates which peers to accept synchronization from:<\/span><\/p>\n The PDCe for the forest root domain should be set to NTP. All other DCs should be NT5DS.<\/em> AnnounceFlags<\/strong>: The value define how the DC announces itself as time server:<\/p>\n This value combines flags using the bitwise OR operator. For each position in the binary value, if any flag has the value of 1 in the corresponding position, the combined value does as well. For example, the flags 1 and 8, which are 0001 and 1000 in binary, are 1001 when combined with bitwise OR.<\/p>\n 0 simply means no announcements, and 1, 2, 4, 8 are the individual bits that decide whether the according function will be announced. It\u2019s been reported that even with Announceflags defaulting to 10 the PDCe may not announce itself as a reliable time server under certain scenarios. Therefore setting it to 5 on the PDCe is a considered best practice. All other DCs should be set to 10 as per default. Setting multiple DCs to 5 can cause problems, as explained by Dimitri Janczak<\/a> in his NtpClient Error 0x800706E1<\/a> article.<\/em><\/p>\n Whilst Microsoft has published some Windows Time Service Tools and Settings<\/a> on TechNet, the three (3) listed above are the most important.<\/p>\n Polling Intervals and Clock Corrections Explained:<\/p>\n If you’re going to use the SpecialPollInterval, you may consider setting it to 900 seconds (15 minutes).<\/em><\/p>\n The MinPollInterval and MaxPollInterval values should not be changed, but be aware that as the actual value in seconds is calculated as a log base-2 number, the time will increase exponentially as you increase these values.<\/em><\/p>\n Some consultants recommend changing the MaxNegPhaseCorrection and MaxPosPhaseCorrection. The Microsoft recommendation is to leave them at their default setting of 17,2800 seconds (48 hours).<\/em><\/p>\n Furthermore, it’s also extremely important to ensure your virtual Domain Controllers are correctly configured.<\/span><\/p>\n I highly recommend reading the following articles for Hyper-V environments:<\/p>\n The script is fully documented, and is based on a previous script written by Carl Webster<\/a>.<\/p>\n The following screen shot shows the screen output.<\/p>\n You can then run the Get-GPO cmdlet to verify that the GPOs were created, User Settings Disabled, and the WMI Filters applied .<\/p>\n The following screen shot shows the GPOs linked to the Domain Controllers OU and WMI Filters .<\/p>\n It’s important to note that the script creates the GPOs with the Enabled (VMICTimeProvider) registry preference value disabled as per the following screen shot.<\/p>\n You then need to manually set Item-Level targeting before enabling the Enabled value so that this still gets applied to virtual machines ONLY as per best practice. We do it this way because there is no simple way to create\/set item-level targeting settings via PowerShell without using a 3rd party product like SDM Software’s GP Automation Engine (GPAE).<\/p>\n You’ll need to do this for all 3 GPOs and then the implementation is complete.<\/p>\n Here is the \n\tCreateTimeServerGPOs.ps1\t(2137 downloads\t)\n<\/a>\n script:<\/p>\n\n
\n
\nThe PDCe for the child (non-forest root) domains should be set to AllSync. All other DCs should be NT5DS.<\/em><\/p>\n\n
![\"AnnounceFlags\"](\"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-content\/uploads\/2014\/01\/AnnounceFlags.png\" "\\"AnnounceFlags\\"")
<\/a><\/p>\n
\nA value of 5 simply is 1+4, so “The domain controller always advertises time service.” and “The domain controller will always advertise reliable time service.”
\n10 (0xa) means 2+8, so “The domain controller automatically determines whether it should advertise time service.” and “The domain controller automatically determines whether it should advertise reliable time service.”<\/p>\n\n
\n
\n
\n
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n\n
\n
<\/a><\/p>\n\n
<\/a><\/p>\n\r\n#>\r\n This script will create the Time Server GPOs and WMI Filters for the Domain Controllers\r\n to ensure your time server hierarchy remains correct for transfer and seizure of the PDC(e)\r\n emulator FSMO role holder. The policies will apply on the next policy refresh or by forcing\r\n a group policy refresh.\r\n\r\n WMI Filters are created via the New-ADObject cmdlet in the Active Directory module, which\r\n makes them of type "Microsoft.ActiveDirectory.Management.ADObject". However, the Group\r\n Policy module requires that you use an object of type "Microsoft.GroupPolicy.WmiFilter"\r\n when adding a wmifilter using the New-GPO cmdlet. Therefore there is no default way to use\r\n the Group Policy PowerShell cmdlets to add WMI Filters to GPOs without a bit or trickery.\r\n As Carl documented there is a "Group Policy WMI filter cmdlet module" available for download\r\n from here: http:\/\/gallery.technet.microsoft.com\/scriptcenter\/Group-Policy-WMI-filter-38a188f3\r\n But if you reverse engineer the code Bin Yi from Microsoft created, you'll see that he has\r\n simply and cleverly converted a "Microsoft.ActiveDirectory.Management.ADObject" object type\r\n to a "Microsoft.GroupPolicy.WmiFilter" object type. I didn't want to include the whole module\r\n for the simple task I needed, so have directly used the ConvertTo-WmiFilter function from the\r\n GPWmiFilter.psm1 module and tweaked it for my requirements. Many thanks to Bin.\r\n\r\n If your Active Directory is based on Windows 2003 or has been upgraded from Windows 2003, you\r\n may may have an issue with System Owned Objects. If you receive an error message along the\r\n lines of "The attribute cannot be modified because it is owned by the system", you'll need to\r\n set the following registry value:\r\n Key: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters\r\n Type: REG_DWORD\r\n Value: Allow System Only Change\r\n Data: 1\r\n\r\n Disable the Hyper-V time synchronization integration service:\r\n - The time source of "VM IC Time Synchronization Provider" (vmictimeprovider.dll) is enabled\r\n on Virtual Machines as part of the Hyper-V Integration Services. The following articles\r\n explain it in more depth and how it should be configured:\r\n - Time Sync Recommendations For Virtual DCs On Hyper-V \u2013 Change In Recommendations (AGAIN)\r\n
(2013-11-17) Time Sync Recommendations For Virtual DCs On Hyper-V – Change In Recommendations (AGAIN)<\/a><\/blockquote>