<div dir='auto'>As has probably already been said via PM to you. pool.ntp.org uses "random" servers. <div dir="auto"><br></div><div dir="auto">I note that you say the error logs do not show the server that sent the bad time. Are you able to pull this from firewall logs perhaps?</div><div dir="auto"><br></div><div dir="auto">Kind Regards,</div><div dir="auto"><br></div><div dir="auto">Jasper Relph </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Jan 31, 2019 17:32, Roy Adams <roy@racs.com.au> wrote:<br type="attribution" /><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="font-family:'verdana' , sans-serif;font-size:small">Thanks for the PM's offering ideas</div><div style="font-family:'verdana' , sans-serif;font-size:small">I am tempted to set it back to 0. to debug the offending ntp pool IP, but it was breaking all the backups among other things due to AD sync being more than 5 mins out.<br /></div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">I always use the below config for domain controllers:</div><div style="font-family:'verdana' , sans-serif"><div>sc config W32Time start= auto & net start W32Time</div><div>w32tm /config /manualpeerlist:"<a href="http://0.au.pool.ntp.org">0.au.pool.ntp.org</a> <a href="http://2.au.pool.ntp.org">2.au.pool.ntp.org</a> <a href="http://3.au.pool.ntp.org">3.au.pool.ntp.org</a>" /syncfromflags:manual /reliable:yes /update & w32tm /resync /nowait</div></div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">One of the replies noted that linux sanity checks by getting ntp time from 4 servers - I wish MS were that smart.</div><div style="font-family:'verdana' , sans-serif">Clearly MS are not using all the configured servers, I suspect they are purely for failover like a DNS client.</div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">I have just changed this site to:</div><div style="font-family:'verdana' , sans-serif"><div>w32tm /config /manualpeerlist:"<a href="http://3.au.pool.ntp.org">3.au.pool.ntp.org</a>" /syncfromflags:manual /reliable:yes /update & w32tm /resync /nowait<br /></div><div>So far so good.. still stable</div></div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">All Domain members of course sync to the DC</div><div style="font-family:'verdana' , sans-serif">I am not seeing this on any other sites.. all sites are cookie cutter for me</div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif"><br /></div><div style="font-family:'verdana' , sans-serif">event logs confirm ONLY the change... not the server IP :(</div><div style="font-family:'verdana' , sans-serif">
<p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T01:47:11.254922100Z from 2019-01-31T02:18:29.514800000Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">
</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T01:47:11.254000000Z from 2019-01-31T01:47:11.254922100Z.</p></div><div style="font-family:'verdana' , sans-serif">
<p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T03:43:51.747000000Z from 2019-01-31T03:12:32.312621000Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">
</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T03:36:17.703840400Z from 2019-01-31T04:07:36.105000000Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">
</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T03:36:17.703000000Z from 2019-01-31T03:36:17.703840400Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">
</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T05:41:23.075000000Z from 2019-01-31T05:10:04.617935900Z.</p></div><div style="font-family:'verdana' , sans-serif">
<p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T06:01:12.107000000Z from 2019-01-31T06:01:12.107000000Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">
</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T05:30:09.707385800Z from 2019-01-31T06:01:28.112628100Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">
</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T05:30:09.707000000Z from 2019-01-31T05:30:09.707385800Z.</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">
</p><p style="margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'">The system time has changed to 2019-01-31T05:39:51.770000000Z from 2019-01-31T05:39:51.770276000Z.</p><p style="margin:0px;font-stretch:normal;font-size:9px;line-height:normal;font-family:'helvetica'"><br /></p><p style="font-size:9px;margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'"><br /></p><p style="font-size:9px;margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'"><br /></p><p style="font-size:9px;margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'"><br /></p><p style="font-size:9px;margin:0px;font-stretch:normal;line-height:normal;font-family:'helvetica'"><br /></p></div><div><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small">Kindly,</span><br /></div><div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><br /></span></div><div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )">ROY ADAMS<b> | </b></span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">P</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a style="color:rgb( 17 , 85 , 204 )">07 3040 5010</a> | </span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Web:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="http://www.racs.com.au/" style="color:rgb( 17 , 85 , 204 )">http://www.racs.com.au/</a> | </span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Wiki:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="https://ex.racs.com.au:444/" style="color:rgb( 17 , 85 , 204 )">https://ex.racs.com.au:444/</a> | e</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Mail:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="mailto:roy@racs.com.au" style="color:rgb( 17 , 85 , 204 )">mailto:roy@racs.com.au</a></span><br /></div><div><font color="#eeeeee" face="verdana, sans-serif"><span style="font-size:10px">Please never upgrade to the latest Windows 10 - You don’t need the hassle, and I don’t need the work.</span></font><br /><font color="#eeeeee" face="verdana, sans-serif"><span style="font-size:10px">If you think it's expensive to hire a professional to do the job, wait until you hire an amateur - Red Adair.</span></font></div><div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt"><font color="#eeeeee">Life is a journey through a series of adventures.. Live them, love them, hate them, but never give up on your dreams, desires, and goals.</font></span></div><div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt"><font color="#eeeeee"><br /></font></span></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br /></div></div></div></div><br /><div class="elided-text"><div dir="ltr">On Thu, 31 Jan 2019 at 16:13, Nick Stallman <<a href="mailto:nick@agentpoint.com">nick@agentpoint.com</a>> wrote:<br /></div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb( 204 , 204 , 204 );padding-left:1ex">
<div>
<p>Do you know which server specifically? The ntp pools hand out
random NTP server IPs, it's not a fixed server.</p>
<p>I'm not a Windows server admin, but this would likely be why
Linux connects to ~4 NTP servers so it can disregard dodgy
servers.<br />
</p>
<div>On 31/1/19 5:09 pm, Roy Adams wrote:<br />
</div>
<blockquote>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div style="font-family:'verdana' , sans-serif;font-size:small">Hi
All, I have a domain controller <b>seemingly</b>
receiving bad time info today from <a href="http://0.au.pool.ntp.org">0.au.pool.ntp.org</a></div>
<div style="font-family:'verdana' , sans-serif;font-size:small">Issuing
this confirmed the time was flapping forward 30 mins,
then 30 mins later back to normal:<br />
</div>
<div><font face="verdana,
sans-serif">w32tm /query /status</font><br />
</div>
<div><font face="verdana,
sans-serif">It confirmed the above ntp server as the
server that supplied the bad (then good, then bad,
then good etc) time</font></div>
<div><font face="verdana,
sans-serif">I have now changed the DC to pull instead
from 3</font><span style="font-family:'verdana' , sans-serif">.<a href="http://au.pool.ntp.org">au.pool.ntp.org</a>.</span></div>
<div><span style="font-family:'verdana' , sans-serif">1 hour has
passed and so far so good.</span></div>
<div>
<div dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><br />
</span></div>
<div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small">C<span style="font-family:'verdana' , sans-serif;font-size:small">annot
say I have ever seen
anything like
this...</span></span></div>
<div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><span style="font-family:'verdana' , sans-serif;font-size:small">It's
only occurring on
one site on a
windows2008r2sp1
domain controller.</span></span></div>
<div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><span style="font-family:'verdana' , sans-serif;font-size:small">The
DC in turn relays
this updated time to
all domain members
of course.</span></span></div>
<div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><span style="font-family:'verdana' , sans-serif;font-size:small"></span></span></div>
<div>
<div style="font-family:'verdana' , sans-serif;font-size:small">Anyone else had
time issues on any
sites today in Aus?</div>
<br />
</div>
<div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><br />
</span></div>
<div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small">Kindly,</span><br />
</div>
<div><span style="color:rgb( 0 , 0 , 0 );font-family:'verdana' , sans-serif;font-size:small"><br />
</span></div>
<div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )">ROY
ADAMS<b> | </b></span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">P</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a style="color:rgb( 17 , 85 , 204 )">07 3040 5010</a> | </span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Web:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="http://www.racs.com.au/" style="color:rgb( 17 , 85 , 204 )">http://www.racs.com.au/</a> | </span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Wiki:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="https://ex.racs.com.au:444/" style="color:rgb( 17 , 85 , 204 )">https://ex.racs.com.au:444/</a> |
e</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:gray">Mail:</span><span style="font-family:'verdana' , sans-serif;font-size:7.5pt;color:rgb( 31 , 73 , 125 )"> <a href="mailto:roy@racs.com.au" style="color:rgb( 17 , 85 , 204 )">mailto:roy@racs.com.au</a></span><br />
</div>
<div><font face="verdana,
sans-serif" color="#eeeeee"><span style="font-size:10px">Please never upgrade to the latest Windows 10 -
You don’t need the
hassle, and I don’t
need the work.</span></font><br />
<font face="verdana,
sans-serif" color="#eeeeee"><span style="font-size:10px">If you think it's expensive to hire a
professional to do
the job, wait until
you hire an amateur
- Red Adair.</span></font></div>
<div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt"><font color="#eeeeee">Life
is a journey through
a series of
adventures.. Live
them, love them,
hate them, but never
give up on your
dreams, desires, and
goals.</font></span></div>
<div><span style="font-family:'verdana' , sans-serif;font-size:7.5pt"><font color="#eeeeee"><br />
</font></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br />
<fieldset></fieldset>
<pre>_______________________________________________
AusNOG mailing list
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
<div>-- <br />
<table style="width:100%;font-family:'arial' , 'helvetica' , sans-serif;font-size:9pt;color:rgb( 102 , 102 , 102 )" cellspacing="0" cellpadding="0"><tbody><tr><td style="font-size:12pt;font-weight:bold;color:rgb( 0 , 204 , 255 )">Nick
Stallman</td></tr><tr><td style="padding:5pt 0px 8pt;font-weight:bold;text-transform:uppercase">Technical Director</td></tr><tr><td style="padding:7pt 0px 10pt;border-top:1px solid rgb( 234 , 234 , 234 )">
<table style="width:100%" cellspacing="0" cellpadding="0"><tbody><tr><td style="width:70%;padding-top:2pt">
<table style="font-family:'arial' , 'helvetica' , sans-serif;font-size:9pt" cellspacing="0" cellpadding="0" align="left"><tbody><tr><td style="padding-right:5pt"><img style="display:block" alt="Email" width="16" height="auto" /></td><td><a style="color:rgb( 154 , 154 , 154 );text-decoration:none" href="mailto:nick@agentpoint.com">nick@agentpoint.com</a></td></tr><tr><td style="padding:5pt 5pt 5pt 0px"><img style="display:block" alt="Phone" width="16" height="auto" /></td><td style="padding:5pt 0px"><a style="color:rgb( 154 , 154 , 154 );text-decoration:none" href="tel:0280396820">02
8039 6820</a></td></tr><tr><td style="padding-right:5pt"><img style="display:block" alt="Website" width="16" height="auto" /></td><td><a style="color:rgb( 154 , 154 , 154 );text-decoration:none" href="https://www.agentpoint.com.au/">www.agentpoint.com.au</a></td></tr></tbody></table>
</td><td style="width:30%;padding-top:5pt">
<table style="width:100%;text-align:right" cellspacing="0" cellpadding="0"><tbody><tr><td><a href="https://www.agentpoint.com.au/"><img style="width:133px;max-width:100%;height:auto" alt="Agentpoint" border="0" /></a></td></tr><tr><td><a href="https://netpoint.group/"><img style="width:100px;max-width:100%;height:auto" alt="Netpoint" border="0" /></a></td></tr></tbody></table>
</td></tr></tbody></table>
</td></tr><tr><td>
<table style="width:100%;font-family:'arial' , 'helvetica' , sans-serif;font-size:9pt" cellspacing="0" cellpadding="0"><tbody><tr><td style="width:50%;padding:6pt 0px 5pt 7pt;background-color:rgb( 102 , 204 , 255 );color:rgb( 255 , 255 , 255 )">Level 3,
100 Harris Street, Pyrmont NSW 2009</td><td style="padding:5pt 7pt 2pt;background:0px 0px no-repeat rgb( 5 , 173 , 237 );text-align:right;vertical-align:middle"> <a href="https://www.facebook.com/agentpoint/"><img alt="Facebook" border="0" /></a> <a href="https://twitter.com/agentpoint"><img alt="Twitter" border="0" /></a> <a href="https://www.instagram.com/Agentpoint/"><img alt="Instagram" border="0" /></a> <a href="https://www.linkedin.com/company/agentpoint-pty-ltd"><img alt="Linkedin" border="0" /></a> </td></tr></tbody></table>
</td></tr></tbody></table>
</div>
</div>
</blockquote></div>
</blockquote></div><br></div>