Configuring Time Settings on Domain Controllers
Active Directory relies on accurate time settings on all member servers, Domain Controllers, and domain-joined workstations. When time settings are misconfigured, multiple critical Active Directory services such as replication and Kerberos authentication will fail bringing the entire Active Directory infrastructure to its knees.
1. In Active Directory, we use the Windows Time service for clock synchronization: W32Time
2. All member machines synchronizes with any Domain Controller
3. In a domain, all Domain Controllers synchronize from the PDC Emulator of that domain using NT5DS (which simply means: follow the domain hierarchy and get me my PDC emulator)
4. The PDC Emulator of a domain should synchronize with any Domain Controller of the parent domain using NTP
5. The PDC Emulator of the root domain in a forest should synchronize with an external time server (could be clock device, a router, another standalone server, an internet time server, etc)
[mai mult...]