Setting up an NTP server in Windows

Windows family operating systems include the W32Time service. This service is designed to synchronize time within an organization. W32Time is responsible for both the client and server parts of the time service, and the same computer can be both a client and an NTP (Network Time Protocol) server.

By default, the time service in Windows is configured as follows:

• When the operating system is installed, Windows starts an NTP client that synchronizes with an external time source;
• When you add a computer to the domain, the type of synchronization changes. All client computers and ordinary servers in the domain use a domain controller for time synchronization, which checks their authenticity;
• When a rank-and-file server is promoted to a domain controller, it runs an NTP server that uses a controller with the PDC emulator role as its time source;
• The PDC emulator, located in the root domain of the forest, is the primary time server for the entire organization. It itself is also synchronized with an external time source.

This scheme works in most cases and does not require intervention. However, the time service structure in Windows may not follow the domain hierarchy and any computer can be designated as a reliable time source.

For example configuring an NTP server in Windows Server 2008 R2, you can configure an NTP server in Windows 7 by analogy.

The time service in Windows Server has no graphical interface and is configured either from the command line or by directly editing the system registry. Let's see the second way:

You need to start the NTP server. Open the registry hive: HKLM\System\CurrentControlSet\services\W32Time\TimeProviders\NtpServer. To enable the NTP server, set the Enabled parameter to 1. Then restart the time service with the command net stop w32time && net start w32time.

After the NTP service is restarted the server is already active and can serve the clients. You can check this with the command w32tm /query /configuration. This command outputs a complete list of the service's parameters. If the NtpServer section contains the line Enabled :1 , then everything is fine, the time server is up and running.

In order for the NTP server to serve clients, you need to open UDP port 123 in the firewall for incoming and outgoing traffic.

Open registry hive: HKLM\System\CurrentControlSet\services\W32Time\Parameters. Here we are primarily interested in the Type parameter, which defines the type of synchronization. It can take the following values:

• NoSync - NTP server doesn't synchronize with any external time source. The system clock built into the CMOS chip of the server itself is used (in turn, this clock can be synchronized from the NMEA source via RS-232, for example);
• NTP - NTP server is synchronized with external time servers, which are specified in the NtpServer registry parameter;
• NT5DS - NTP server synchronizes according to domain hierarchy;
• AllSync - NTP server uses all available sources for synchronization.

The default value for a domain member computer is NT5DS, for a stand-alone computer is NTP.

The NtpServer parameter specifies the NTP servers with which this server will synchronize time. By default, this parameter specifies the Microsoft NTP server (time.windows.com, 0×1), you can add more NTP servers by entering their DNS names or IP addresses separated by a space, if necessary. At the end of each name you can add a flag (e.g.,0×1) that defines the mode for synchronization with the time server.

The following mode values are allowed:

• 0×1 - SpecialInterval, use time interval polling;
• 0×2 - UseAsFallbackOnly mode;
• 0×4 - SymmetricActive, symmetric active mode;
• 0×8 - Client, sending the request in client mode.

Another important parameter AnnounceFlags is located in the registry section: HKLM\System\CurrentControlSet\services\W32Time\Config. It is responsible for how the NTP server declares itself. To declare an ordinary server (not the domain controller) as a reliable source of time, you need flag 5.

If the configured server in turn is an NTP client (gets time from a GPS receiver via NTP, for example), you can configure the interval between updates. This parameter may also be relevant for client PCs. The “SpecialPollInterval” key, located in the registry branch, is responsible for the update time: HKLM\System\CurrentControlSet\services\W32Time\TimeProviders\NtpClient. This is set in seconds and the default value is 604800, which is 1 week. This is too much, so it is worth reducing the SpecialPollInterval to a reasonable value of 1 hour (3600).

After the configuration is done, the service has to be reconfigured. You can do this with the command w32tm /config /update.

And a few more commands to configure, monitor and diagnose the time service:

• w32tm /monitor - with this option you can find out how much the system time of this computer differs from the time on the domain controller or other computers. For example: w32tm /monitor /computers:time.nist.gov
• w32tm /resync - using this command you can force the computer to synchronize with the time server it uses.
• w32tm /stripchart - shows the time difference between the current and the remote computer. The command w32tm /stripchart /computer:time.nist.gov /samples:5 /dataonly makes 5 comparisons with the specified source and displays the result in text form.
• “w32tm /config” is the main command used to configure the NTP service. It can be used to set the list of time servers used, the type of synchronization and much more. For example, you can override the default values and set the time synchronization with an external source with the command w32tm /config /syncfromflags:manual /manualpeerlist:time.nist.gov /update.
• w32tm /query - shows the current settings of the service. For example w32tm /query /source will show the current time source, and w32tm /query /configuration will show all the service settings.
• net stop w32time - stops the time service if it is running.
• w32tm /unregister - removes the time service from your computer.
• w32tm /register - registers the time service on the computer. This re-creates the entire registry branch.
• net start w32time - starts the service.

Features seen in Windows 7 - the time service does not start automatically at Windows startup. Fixed in SP1 for Windows 7.