Is it possible to serve time for Windows?



  • Is it possible to serve time for Windows?

    I can set time.windows.com and have Windows automatically synchronize time with Internet. But if I set IP address of pfSense box, Windows is unable to sync.

    Is it possible to set up on server side?



  • Is the NTP service configured on pfSense (Services > NTP)?

    Why do you think, Windows doesn't sync?
    Try

    w32tm /stripchart /computer:<pfSense IP>
    

    Also ensure that access to pfSense UDP/123 is permitted.


  • LAYER 8 Moderator

    Also check for some AD dark magic that sets Windows to a setting that won't work with standard-NTP servers. There was something about SNTP servers I remember vaguely that made it incompatible with normal running default NTP. Resetting that via an AD directive to "normal" NTP fixed it. Normally SNTP and NTP aren't incompatible but somehow our Windows DC didn't "understand" that ;)



  • I tried it for a while, but it seemed to fail more than it succeeded (workgroup only). Even NTP for the FW itself would fail at times. Nothing wrong with time.windows,com. Always works.


  • LAYER 8 Global Moderator

    @provels said in Is it possible to serve time for Windows?:

    Nothing wrong with time.windows,com. Always works.

    Not true at all... Back in 2017 there was a massive issue where it was sending out the wrong time ;)

    Even NTP for the FW itself would fail at times

    Well where were you pointing it - pool? Or time.windows.com???

    NTP is rock solid protocol.. And just works - unless you have something blocking it or some serious network issues. I always just replace the built in windows time stuff with the official ntp client..

    Out of the box pretty sure windows before 10 just used sntp, and you need to make some reg changes if you want it to actually use nt with the built in stuff. But a sntp client can get time from any ntp server - its just how it works that is different.

    What flavor of windows are you running? But yeah if you want to use pfsense - you need to validate its ntp is actually running and working, and you have firewall rules to allow access to it.

    If you want to use the actual ntp client for windows you can grab copy here
    https://www.meinbergglobal.com/english/sw/ntp.htm#ntp_stable



  • Heres how I configure my Server 2016/2019 boxes with pfSense NTP server.

    On fresh boot syncs with time.microsoft.com

    w32tm /query /status
    
    Leap Indicator: 0(no warning)
    Stratum: 3 (secondary reference - syncd by (S)NTP)
    Precision: -23 (119.209ns per tick)
    Root Delay: 0.0843484s
    Root Dispersion: 0.0506468s
    ReferenceId: 0x34ADC1A6 (source IP:  __52.173.193.166__)
    Last Successful Sync Time: 6/23/2019 7:15:05 PM
    Source: time.windows.com,0x8
    Poll Interval: 10 (1024s)
    

    set IP address to pfSense NTP server

    w32tm /config /manualpeerlist:192.168.10.1 /syncfromflags:MANUAL
    

    stop and start the time service

    stop-service w32time
    start-service w32time
    

    give it s few moments and verify its syncing correctly.

    w32tm /query /status
    
    Leap Indicator: 0(no warning)
    Stratum: 3 (secondary reference - syncd by (S)NTP)
    Precision: -23 (119.209ns per tick)
    Root Delay: 0.0006681s
    Root Dispersion: 7.7694645s
    ReferenceId: 0xC0A80A01 (source IP:  192.168.10.1)
    Last Successful Sync Time: 6/23/2019 7:17:54 PM
    Source: 192.168.10.1
    Poll Interval: 6 (64s)
    

    and after some time it will be more accurate

    w32tm /query /status
    Leap Indicator: 0(no warning)
    Stratum: 3 (secondary reference - syncd by (S)NTP)
    Precision: -23 (119.209ns per tick)
    Root Delay: 0.0004008s
    Root Dispersion: 0.0414628s
    ReferenceId: 0xC0A80A01 (source IP:  192.168.10.1)
    Last Successful Sync Time: 6/29/2019 12:18:32 AM
    Source: 192.168.10.1
    Poll Interval: 9 (512s)
    

  • LAYER 8 Moderator

    No problems here either after reconfiguring AD with changes to (S)NTP it was working rock solid as always.


Log in to reply