B
Barkley Bees
Guest
We are experiencing a problem with NTP in our AD network. Our Win2003 PDC is
configured to get NTP information from our internal core switch. When we
initally set this up it was working fine (see below success W32Time events):
-----------------------
Event ID 37:
The time provider NtpClient is currently receiving valid time data from
###.###.###.### (ntp.m|0x1|###.###.###.###:123->###.###.###.###:123).
Evenit ID 35:
The time service is now synchronizing the system time with the time source
###.###.###.### (ntp.m|0x1|###.###.###.###:123->###.###.###.###:123).
-----------------------
....but then after 2-3 days it suddenly started failing and ever since we are
getting the following W32Time related errors in the event log:
-----------------------
Event ID 38:
The time provider NtpClient cannot reach or is currently receiving invalid
time data from ###.###.###.###
(ntp.m|0x1|###.###.###.###:123->###.###.###.###:123).
Event ID 47:
Time Provider NtpClient: No valid response has been received from manually
configured peer ###.###.###.###,0x1 after 8 attempts to contact it. This
peer will be discarded as a time source and NtpClient will attempt to
discover a new peer with this DNS name.
Event ID 29:
The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 15 minutes. NtpClient has no
source of accurate time.
-----------------------
1. Performing a dumpreg I get the below output in which nothing appears
amiss: C:\>w32tm /dumpreg /subkey
arameters
Value Name Value Type Value Data
-------------------------------------------------
ServiceMain REG_SZ SvchostEntry_W32Time
ServiceDll REG_EXPAND_SZ C:\WINDOWS\system32\w32time.dll
NtpServer REG_SZ ###.###.###.###,0x1
Type REG_SZ NTP
2. Doing w32tm /monitor outputs the below:
C:\>w32tm /monitor /computers:###.###.###.###
###.###.###.### [###.###.###.###]:
ICMP: 0ms delay.
NTP: +73.9693781s offset from local clock
RefID: (unknown) [127.127.7.1]
3. I then performed a port query and got the below:
C:\>portqry -n ###.###.###.### -e 123 -p UDP
Querying target system called:
###.###.###.###
Attempting to resolve IP address to a name...
Failed to resolve IP address to name
UDP port 123 (ntp service): LISTENING or FILTERED
4. Doing a Resync or Rediscover resulted in the below errors:
C:\>w32tm /resync
Sending resync command to local computer...
The computer did not resync because no time data was available.
-----------------------
C:\>w32tm /resync /rediscover
Sending resync command to local computer...
The computer did not resync because no time data was available.
5. I then turned on debug logging for Windows Time Service
(http://support.microsoft.com/kb/816043/). Here is a sample portion of the
log that is of concern:
148794 01:55:09.1875000s - Packet test 8 failed (bad value for root delay or
root dispersion).
148794 01:55:09.1875000s - Ignoring packet that failed tests from
###.###.###.### (ntp.m|0x1|###.###.###.###:123->###.###.###.###:123).
I can see in the logs that the PDC is able to communicate with our core
switch but then it spits out the above error message for which I can find no
information whatsoever to help me troubleshoot the issue.
6. I checked over the GPO's being applied to the PDC (C:\>gpresult /z >
c:\gp.txt) to ensure that nothing in the policies (Computer
configuration/Administrative Templates /System/Windows Time service/Time
Providers) would be conflicting with the NTP. I could see nothing that would
be related.
7. I found the following, thread at msfn.org to be extremely helpful:
http://www.msfn.org/board/lofiversion/index.php/t67060.html.
This document was also quite informative:
http://www.mmmug.co.uk/files/216/download.aspx (unfortunately though,
these did not resolve the issue for me).
If anyone has experienced similar issues that can provide some words of
wisdom, I'd much appreciate it (as I'm at my wits end). Thanks very much.
configured to get NTP information from our internal core switch. When we
initally set this up it was working fine (see below success W32Time events):
-----------------------
Event ID 37:
The time provider NtpClient is currently receiving valid time data from
###.###.###.### (ntp.m|0x1|###.###.###.###:123->###.###.###.###:123).
Evenit ID 35:
The time service is now synchronizing the system time with the time source
###.###.###.### (ntp.m|0x1|###.###.###.###:123->###.###.###.###:123).
-----------------------
....but then after 2-3 days it suddenly started failing and ever since we are
getting the following W32Time related errors in the event log:
-----------------------
Event ID 38:
The time provider NtpClient cannot reach or is currently receiving invalid
time data from ###.###.###.###
(ntp.m|0x1|###.###.###.###:123->###.###.###.###:123).
Event ID 47:
Time Provider NtpClient: No valid response has been received from manually
configured peer ###.###.###.###,0x1 after 8 attempts to contact it. This
peer will be discarded as a time source and NtpClient will attempt to
discover a new peer with this DNS name.
Event ID 29:
The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 15 minutes. NtpClient has no
source of accurate time.
-----------------------
1. Performing a dumpreg I get the below output in which nothing appears
amiss: C:\>w32tm /dumpreg /subkey
arametersValue Name Value Type Value Data
-------------------------------------------------
ServiceMain REG_SZ SvchostEntry_W32Time
ServiceDll REG_EXPAND_SZ C:\WINDOWS\system32\w32time.dll
NtpServer REG_SZ ###.###.###.###,0x1
Type REG_SZ NTP
2. Doing w32tm /monitor outputs the below:
C:\>w32tm /monitor /computers:###.###.###.###
###.###.###.### [###.###.###.###]:
ICMP: 0ms delay.
NTP: +73.9693781s offset from local clock
RefID: (unknown) [127.127.7.1]
3. I then performed a port query and got the below:
C:\>portqry -n ###.###.###.### -e 123 -p UDP
Querying target system called:
###.###.###.###
Attempting to resolve IP address to a name...
Failed to resolve IP address to name
UDP port 123 (ntp service): LISTENING or FILTERED
4. Doing a Resync or Rediscover resulted in the below errors:
C:\>w32tm /resync
Sending resync command to local computer...
The computer did not resync because no time data was available.
-----------------------
C:\>w32tm /resync /rediscover
Sending resync command to local computer...
The computer did not resync because no time data was available.
5. I then turned on debug logging for Windows Time Service
(http://support.microsoft.com/kb/816043/). Here is a sample portion of the
log that is of concern:
148794 01:55:09.1875000s - Packet test 8 failed (bad value for root delay or
root dispersion).
148794 01:55:09.1875000s - Ignoring packet that failed tests from
###.###.###.### (ntp.m|0x1|###.###.###.###:123->###.###.###.###:123).
I can see in the logs that the PDC is able to communicate with our core
switch but then it spits out the above error message for which I can find no
information whatsoever to help me troubleshoot the issue.
6. I checked over the GPO's being applied to the PDC (C:\>gpresult /z >
c:\gp.txt) to ensure that nothing in the policies (Computer
configuration/Administrative Templates /System/Windows Time service/Time
Providers) would be conflicting with the NTP. I could see nothing that would
be related.
7. I found the following, thread at msfn.org to be extremely helpful:
http://www.msfn.org/board/lofiversion/index.php/t67060.html.
This document was also quite informative:
http://www.mmmug.co.uk/files/216/download.aspx (unfortunately though,
these did not resolve the issue for me).
If anyone has experienced similar issues that can provide some words of
wisdom, I'd much appreciate it (as I'm at my wits end). Thanks very much.