External Time Source

The following will walk you through configuring an external time source for your domain. This is done through a GPO which configures the DC running the PDC Emulator role to use an external NTP server(s) as its time source.

Hyper-V Time Service (Optional)

If the DCs are running as VMs on Hyper-V, ensure the Time Synchronization Integrated Service is disabled. This service, if left enabled, will cause the DCs to synchronize their time against the hypervisors clock rather than NTP.

Run the following command on the hypervisors, specifying which VM you’d like the Time Synchronization Integrated Service to be disabled.

Disable-VMIntegrationService -Name "Time Synchronization" -VMName DC1

WMI Filter

Create a WMI filter that targets only the the DC running the PDC Emulator role. This is required so the GPO is only applied against the DC running the PDC Emulator role.

Select * from Win32_ComputerSystem where DomainRole = 5

GPO Configuration

Create a new GPO with the following settings. For this article, we will be using NTP Pool Project as our time source.

1. Browse to Computer >> Administrative Templates >> System >> Windows Time Service >> Time Providers.
2. Enable Enable Windows NTP Client.
3. Enable Configure Windows NTP Client and configure with the following settings:

4. Ensure the WMI filter created in the previous step, is selected on the GPO.
5. Apply the GPO against the Domain Controllers OU.