0

I am on a domain-joined Laptop which cannot connect to the domain controller except once a month or less, so the system time is off by 10 seconds. I can set it manually, but I'd like it to sync to public NTP servers instead. So some reason, it won't do that.

enter image description here

You also see that "some settings are hidden or managed by [my] organization".

w32tm /query /configuration shows me that some policy sets time time source Type to NT5DS:

[Configuration]

EventLogFlags: 2 (Local)
AnnounceFlags: 10 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 10 (Local)
MaxPollInterval: 15 (Local)
MaxNegPhaseCorrection: 4294967295 (Local)
MaxPosPhaseCorrection: 4294967295 (Local)
MaxAllowedPhaseOffset: 300 (Local)

FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 1 (Local)
UpdateInterval: 30000 (Local)

FileLogName: D:\time.log (Local)
FileLogEntries: 0-300 (Local)
FileLogSize: 1000000 (Local)

[TimeProviders]

NtpServer (Local)
DllName: C:\WINDOWS\system32\w32time.dll (Local)
Enabled: 1 (Policy)
InputProvider: 0 (Local)
AllowNonstandardModeCombinations: 1 (Local)

NtpClient (Local)
DllName: C:\WINDOWS\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
CrossSiteSyncFlags: 2 (Policy)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Policy)
ResolvePeerBackoffMaxTimes: 7 (Policy)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 0 (Policy)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (Policy)
Type: NT5DS (Policy)

My question is: where can I see where these things are set? I cannot seem to find anything in rsop.msc (anything I check there is "Not defined") or gpresult.exe.

How can I see where these settings are set so I can figure out if I can override them?

bers
  • 1,558
  • 21
  • 30
  • Domain clients have to synch to the domain controller. – user1292580 Nov 21 '21 at 16:25
  • This mark as a duplicate is incorrect. The other question is for non-domain joined systems, while my system *is* domain-joined. (And I tried the solution without success.) – bers Nov 22 '21 at 07:23
  • In the particular question of NTP vs. NT5DS, I found `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\W32time` which I could rename to remove the NT5DS setting. This does not answer the question, however, because "Some of these settings ..." still appears, even after a reboot. – bers Nov 22 '21 at 07:24
  • 1
    Security **requires** clients and servers agree on the time. Clients take their time from their domain servers. Anything else is a risk. – user1292580 Nov 22 '21 at 07:50
  • @user1292580 I agree with your 1st sentence. The 2nd does not apply: I cannot contact the domain servers for weeks at a time. So following your logic, security *requires* me to get a reliable time from some place else, wouldn't you agree? – bers Nov 23 '21 at 08:11

0 Answers0