<div dir='auto'>As has probably already been said via PM to you. pool.ntp.org uses "random" servers. <div dir="auto"><br></div><div dir="auto">I note that you say the error logs do not show the server that sent the bad time. Are you able to pull this from firewall logs perhaps?</div><div dir="auto"><br></div><div dir="auto">Kind Regards,</div><div dir="auto"><br></div><div dir="auto">Jasper Relph </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Jan 31, 2019 17:32, Roy Adams <roy@racs.com.au> wrote:<br type="attribution" /><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="font-family:'verdana' , sans-serif;font-size:small">Thanks for the PM's offering ideas</div><div style="font-family:'verdana' , sans-serif;font-size:small">I am tempted to set it back to 0. to debug the offending ntp pool IP, but it was breaking all the backups among other things due to AD sync being more than 5 mins out.<br /></div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">I always use the below config for domain controllers:</div><div style="font-family:'verdana' , sans-serif"><div>sc config W32Time start= auto & net start W32Time</div><div>w32tm /config /manualpeerlist:"<a href="http://0.au.pool.ntp.org">0.au.pool.ntp.org</a> <a href="http://2.au.pool.ntp.org">2.au.pool.ntp.org</a> <a href="http://3.au.pool.ntp.org">3.au.pool.ntp.org</a>" /syncfromflags:manual /reliable:yes /update & w32tm /resync /nowait</div></div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">One of the replies noted that linux sanity checks by getting ntp time from 4 servers - I wish MS were that smart.</div><div style="font-family:'verdana' , sans-serif">Clearly MS are not using all the configured servers, I suspect they are purely for failover like a DNS client.</div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">I have just changed this site to:</div><div style="font-family:'verdana' , sans-serif"><div>w32tm /config /manualpeerlist:"<a href="http://3.au.pool.ntp.org">3.au.pool.ntp.org</a>" /syncfromflags:manual /reliable:yes /update & w32tm /resync /nowait<br /></div><div>So far so good.. still stable</div></div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">All Domain members of course sync to the DC</div><div style="font-family:'verdana' , sans-serif">I am not seeing this on any other sites.. all sites are cookie cutter for me</div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">event logs confirm ONLY the change... not the server IP :(</div><div style="font-family:'verdana' , sans-serif">





<p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T01:47:11.254922100Z from ‎2019‎-‎01‎-‎31T02:18:29.514800000Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">





</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T01:47:11.254000000Z from ‎2019‎-‎01‎-‎31T01:47:11.254922100Z.</p></div><div style="font-family:'verdana' , sans-serif">





<p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T03:43:51.747000000Z from ‎2019‎-‎01‎-‎31T03:12:32.312621000Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">





</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T03:36:17.703840400Z from ‎2019‎-‎01‎-‎31T04:07:36.105000000Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">





</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T03:36:17.703000000Z from ‎2019‎-‎01‎-‎31T03:36:17.703840400Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">





</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T05:41:23.075000000Z from ‎2019‎-‎01‎-‎31T05:10:04.617935900Z.</p></div><div style="font-family:'verdana' , sans-serif">





<p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T06:01:12.107000000Z from ‎2019‎-‎01‎-‎31T06:01:12.107000000Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">





</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T05:30:09.707385800Z from ‎2019‎-‎01‎-‎31T06:01:28.112628100Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">





</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T05:30:09.707000000Z from ‎2019‎-‎01‎-‎31T05:30:09.707385800Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">





</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to ‎2019‎-‎01‎-‎31T05:39:51.770000000Z from ‎2019‎-‎01‎-‎31T05:39:51.770276000Z.</p><p style="margin:0px;font-stretch:normal;font-size:9px;line-height:normal;font-family:'helvetica'"><br /></p><p style="font-size:9px;margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'"><br /></p><p style="font-size:9px;margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'"><br /></p><p style="font-size:9px;margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'"><br /></p><p style="font-size:9px;margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'"><br /></p></div><div><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small">Kindly,</span><br /></div><div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><br /></span></div><div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )">ROY ADAMS<b> | </b></span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">P</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a style="color:rgb( 17 , 85 , 204 )">07 3040 5010</a>  | </span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Web:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="http://www.racs.com.au/" style="color:rgb( 17 , 85 , 204 )">http://www.racs.com.au/</a> | </span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Wiki:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="https://ex.racs.com.au:444/" style="color:rgb( 17 , 85 , 204 )">https://ex.racs.com.au:444/</a> | e</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Mail:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="mailto:roy@racs.com.au" style="color:rgb( 17 , 85 , 204 )">mailto:roy@racs.com.au</a></span><br /></div><div><font color="#eeeeee" face="verdana, sans-serif"><span style="font-size:10px">Please never upgrade to the latest Windows 10 - You don’t need the hassle, and I don’t need the work.</span></font><br /><font color="#eeeeee" face="verdana, sans-serif"><span style="font-size:10px">If you think it's expensive to hire a professional to do the job, wait until you hire an amateur - Red Adair.</span></font></div><div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt"><font color="#eeeeee">Life is a journey through a series of adventures.. Live them, love them, hate them, but never give up on your dreams, desires, and goals.</font></span></div><div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt"><font color="#eeeeee"><br /></font></span></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br /></div></div></div></div><br /><div class="elided-text"><div dir="ltr">On Thu, 31 Jan 2019 at 16:13, Nick Stallman <<a href="mailto:nick@agentpoint.com">nick@agentpoint.com</a>> wrote:<br /></div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb( 204 , 204 , 204 );padding-left:1ex">
  
    
  
  <div>
    <p>Do you know which server specifically? The ntp pools hand out
      random NTP server IPs, it's not a fixed server.</p>
    <p>I'm not a Windows server admin, but this would likely be why
      Linux connects to ~4 NTP servers so it can disregard dodgy
      servers.<br />
    </p>
    <div>On 31/1/19 5:09 pm, Roy Adams wrote:<br />
    </div>
    <blockquote>
      
      <div dir="ltr">
        <div dir="ltr">
          <div dir="ltr">
            <div dir="ltr">
              <div style="font-family:'verdana' , sans-serif;font-size:small">Hi
                All, I have a domain controller <b>seemingly</b>
                receiving bad time info today from <a href="http://0.au.pool.ntp.org">0.au.pool.ntp.org</a></div>
              <div style="font-family:'verdana' , sans-serif;font-size:small">Issuing
                this confirmed the time was flapping forward 30 mins,
                then 30 mins later back to normal:<br />
              </div>
              <div><font face="verdana,
                  sans-serif">w32tm /query /status</font><br />
              </div>
              <div><font face="verdana,
                  sans-serif">It confirmed the above ntp server as the
                  server that supplied the bad (then good, then bad,
                  then good etc) time</font></div>
              <div><font face="verdana,
                  sans-serif">I have now changed the DC to pull instead
                  from 3</font><span style="font-family:'verdana' , sans-serif">.<a href="http://au.pool.ntp.org">au.pool.ntp.org</a>.</span></div>
              <div><span style="font-family:'verdana' , sans-serif">1 hour has
                  passed and so far so good.</span></div>
              <div>
                <div dir="ltr">
                  <div dir="ltr">
                    <div>
                      <div dir="ltr">
                        <div>
                          <div dir="ltr">
                            <div dir="ltr">
                              <div dir="ltr">
                                <div dir="ltr">
                                  <div dir="ltr">
                                    <div dir="ltr">
                                      <div dir="ltr">
                                        <div dir="ltr">
                                          <div dir="ltr">
                                            <div dir="ltr">
                                              <div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><br />
                                                </span></div>
                                              <div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small">C<span style="font-family:'verdana' , sans-serif;font-size:small">annot
                                                    say I have ever seen
                                                    anything like
                                                    this...</span></span></div>
                                              <div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><span style="font-family:'verdana' , sans-serif;font-size:small">It's
                                                    only occurring on
                                                    one site on a
                                                    windows2008r2sp1
                                                    domain controller.</span></span></div>
                                              <div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><span style="font-family:'verdana' , sans-serif;font-size:small">The
                                                    DC in turn relays
                                                    this updated time to
                                                    all domain members
                                                    of course.</span></span></div>
                                              <div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><span style="font-family:'verdana' , sans-serif;font-size:small"></span></span></div>
                                              <div>
                                                <div style="font-family:'verdana' , sans-serif;font-size:small">Anyone else had
                                                  time issues on any
                                                  sites today in Aus?</div>
                                                <br />
                                              </div>
                                              <div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><br />
                                                </span></div>
                                              <div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small">Kindly,</span><br />
                                              </div>
                                              <div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><br />
                                                </span></div>
                                              <div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )">ROY
                                                  ADAMS<b> | </b></span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">P</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a style="color:rgb( 17 , 85 , 204 )">07 3040 5010</a>  | </span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Web:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="http://www.racs.com.au/" style="color:rgb( 17 , 85 , 204 )">http://www.racs.com.au/</a> | </span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Wiki:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="https://ex.racs.com.au:444/" style="color:rgb( 17 , 85 , 204 )">https://ex.racs.com.au:444/</a> |
                                                  e</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Mail:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="mailto:roy@racs.com.au" style="color:rgb( 17 , 85 , 204 )">mailto:roy@racs.com.au</a></span><br />
                                              </div>
                                              <div><font face="verdana,
                                                  sans-serif" color="#eeeeee"><span style="font-size:10px">Please never upgrade to the latest Windows 10 -
                                                    You don’t need the
                                                    hassle, and I don’t
                                                    need the work.</span></font><br />
                                                <font face="verdana,
                                                  sans-serif" color="#eeeeee"><span style="font-size:10px">If you think it's expensive to hire a
                                                    professional to do
                                                    the job, wait until
                                                    you hire an amateur
                                                    - Red Adair.</span></font></div>
                                              <div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt"><font color="#eeeeee">Life
                                                    is a journey through
                                                    a series of
                                                    adventures.. Live
                                                    them, love them,
                                                    hate them, but never
                                                    give up on your
                                                    dreams, desires, and
                                                    goals.</font></span></div>
                                              <div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt"><font color="#eeeeee"><br />
                                                  </font></span></div>
                                            </div>
                                          </div>
                                        </div>
                                      </div>
                                    </div>
                                  </div>
                                </div>
                              </div>
                            </div>
                          </div>
                        </div>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
      <br />
      <fieldset></fieldset>
      <pre>_______________________________________________
AusNOG mailing list
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
    </blockquote>
    <div>-- <br />
      <table style="width:100%;font-family:'arial' , 'helvetica' , sans-serif;font-size:9pt;color:rgb( 102 , 102 , 102 )" cellspacing="0" cellpadding="0"><tbody><tr><td style="font-size:12pt;font-weight:bold;color:rgb( 0 , 204 , 255 )">Nick
              Stallman</td></tr><tr><td style="padding:5pt 0px 8pt;font-weight:bold;text-transform:uppercase">Technical Director</td></tr><tr><td style="padding:7pt 0px 10pt;border-top:1px solid rgb( 234 , 234 , 234 )">
              <table style="width:100%" cellspacing="0" cellpadding="0"><tbody><tr><td style="width:70%;padding-top:2pt">
                      <table style="font-family:'arial' , 'helvetica' , sans-serif;font-size:9pt" cellspacing="0" cellpadding="0" align="left"><tbody><tr><td style="padding-right:5pt"><img style="display:block" alt="Email" width="16" height="auto" /></td><td><a style="color:rgb( 154 , 154 , 154 );text-decoration:none" href="mailto:nick@agentpoint.com">nick@agentpoint.com</a></td></tr><tr><td style="padding:5pt 5pt 5pt 0px"><img style="display:block" alt="Phone" width="16" height="auto" /></td><td style="padding:5pt 0px"><a style="color:rgb( 154 , 154 , 154 );text-decoration:none" href="tel:0280396820">02
                                8039 6820</a></td></tr><tr><td style="padding-right:5pt"><img style="display:block" alt="Website" width="16" height="auto" /></td><td><a style="color:rgb( 154 , 154 , 154 );text-decoration:none" href="https://www.agentpoint.com.au/">www.agentpoint.com.au</a></td></tr></tbody></table>
                    </td><td style="width:30%;padding-top:5pt">
                      <table style="width:100%;text-align:right" cellspacing="0" cellpadding="0"><tbody><tr><td><a href="https://www.agentpoint.com.au/"><img style="width:133px;max-width:100%;height:auto" alt="Agentpoint" border="0" /></a></td></tr><tr><td><a href="https://netpoint.group/"><img style="width:100px;max-width:100%;height:auto" alt="Netpoint" border="0" /></a></td></tr></tbody></table>
                    </td></tr></tbody></table>
            </td></tr><tr><td>
              <table style="width:100%;font-family:'arial' , 'helvetica' , sans-serif;font-size:9pt" cellspacing="0" cellpadding="0"><tbody><tr><td style="width:50%;padding:6pt 0px 5pt 7pt;background-color:rgb( 102 , 204 , 255 );color:rgb( 255 , 255 , 255 )">Level 3,
                      100 Harris Street, Pyrmont NSW 2009</td><td style="padding:5pt 7pt 2pt;background:0px 0px no-repeat rgb( 5 , 173 , 237 );text-align:right;vertical-align:middle"> <a href="https://www.facebook.com/agentpoint/"><img alt="Facebook" border="0" /></a> <a href="https://twitter.com/agentpoint"><img alt="Twitter" border="0" /></a> <a href="https://www.instagram.com/Agentpoint/"><img alt="Instagram" border="0" /></a> <a href="https://www.linkedin.com/company/agentpoint-pty-ltd"><img alt="Linkedin" border="0" /></a> </td></tr></tbody></table>
            </td></tr></tbody></table>
    </div>
  </div>

</blockquote></div>
</blockquote></div><br></div>