This guide explains how to configure Windows Server 2022 to synchronise time with an external Network Time Protocol (NTP) source in an Active Directory environment. The normal design is to configure the PDC Emulator in the forest root domain to use an external time source. Other domain controllers, member servers and workstations should normally continue to synchronise through the Active Directory domain hierarchy.

If you are maintaining an older environment, see the companion guide for configuring external NTP time synchronisation on Windows Server 2008 R2 SP1.

Accurate time is important for Active Directory and Kerberos authentication. If clocks drift too far apart, users and services can experience authentication problems.

Important: These instructions are for a conventional AD DS domain. Do not configure every domain controller to use an external NTP server. In a multi-domain forest, identify the PDC Emulator in the forest root domain, not simply the PDC Emulator in the domain you happen to be working in.

1. Identify the forest-root PDC Emulator

Run the following command in PowerShell to identify the PDC Emulator for the domain:

In a single-domain forest, this is also the forest-root PDC Emulator. In a multi-domain forest, run the command against the forest root domain. You can also use the following command to list the FSMO role holders:

2. Choose your external NTP servers

You can use an organisation-approved NTP service, an internal time appliance, or a public service such as the NTP Pool Project. The examples below use three NTP Pool servers. The pool distributes requests across participating time servers; for UK-specific pool entries you can use 0.uk.pool.ntp.org, 1.uk.pool.ntp.org and 2.uk.pool.ntp.org.

For production environments, follow your organisation’s time-service and security standards. A dedicated, monitored time source may be preferable to a public pool. Public NTP traffic is not authenticated by default, so use a trusted source and protect the time-service path appropriately.

3. Configure the PDC Emulator to use external NTP

Sign in to the forest-root PDC Emulator and open an elevated Command Prompt or PowerShell session. Configure the manual peer list and mark this domain controller as a reliable time source:

What the options do:

• /manualpeerlist specifies the external NTP servers. Multiple peers are separated by spaces and the list must be enclosed in quotation marks.
• ,0x8 selects NTP client mode for each peer.
• /syncfromflags:manual tells Windows Time to use the configured manual peer list.
• /reliable:yes marks this domain controller as a reliable time source for domain clients.
• /update notifies the Windows Time service that its configuration has changed.

4. Restart the Windows Time service and resynchronise

The /update option applies the configuration. To restart the service and request a fresh synchronisation, run:

If the resynchronisation request fails, don’t assume the configuration is correct just because the command was accepted. Continue with the verification and troubleshooting steps below.

5. Verify that the server is synchronising

Use these commands to check the selected time source, synchronisation status, configured peers and effective Windows Time settings:

On the forest-root PDC Emulator, the reported source should be one of the configured external peers once synchronisation has succeeded. Check the Source and Last Successful Sync Time fields in the status output. The configuration output also helps identify whether settings are coming from local configuration or Group Policy.

6. Configure domain clients and other domain controllers

Domain-joined workstations, member servers and other domain controllers should normally use the Active Directory time hierarchy rather than being configured with public NTP peers directly.

If a domain member has previously been configured with a manual time source, return it to domain-hierarchy synchronisation by running the following command in an elevated session:

The /reliable:no option removes the reliable-time-source designation from that computer. This is particularly important if a server previously held the PDC Emulator role and has since lost it.

You can check a domain member’s time source with:

7. Test NTP connectivity

The Windows Time service uses UDP port 123 for NTP. Make sure the forest-root PDC Emulator can resolve and reach the configured external time servers, and that the required outbound traffic is permitted by your firewall.

The /stripchart command is useful for testing whether an NTP server is responding:

8. Troubleshooting common issues

The time source is still Local CMOS Clock

Check that the peer list is correctly configured, DNS resolution works, outbound UDP 123 is allowed and the Windows Time service is running. Then inspect the effective settings with w32tm /query /configuration. A Group Policy setting can override local configuration.

The resynchronisation command fails

Check the Windows Time events in Event Viewer under Applications and Services Logs > Microsoft > Windows > Time-Service > Operational, along with the System log. Confirm that the configured peer names resolve and that NTP traffic is permitted.

The PDC Emulator role has moved to another server

The external time configuration should follow the PDC Emulator role. Configure the new forest-root PDC Emulator with the approved external peers and verify synchronisation. Return the previous role holder to domain-hierarchy synchronisation using the commands in section 6. Review any Group Policy settings that may enforce the old configuration.

Useful Microsoft documentation

• Windows Time Service tools and settings
• How the Windows Time service works
• Configure an authoritative time server
• NTP Pool Project

That covers the basic configuration and verification of external time synchronisation for a Windows Server 2022 Active Directory environment. If you have any questions or run into an issue, feel free to leave a comment below.