no internet time tab on domain controller, Windows Server 2016

Question

I got an ActiveDirectory with one domain controller that run on Windows Server 2016. I set everything up and most of the things run perfectly so far.

But now and then when we have to take it offline, the time is set back from the exact amount of time which the server was offline. (e.g. its now 09:00, but server was 10min offline --> servertime 08:50)

However this should be no problem because of the automatic syncing of the time right? The problem now is that the Tab to configure this is not available, it is simply not shown. In the "new-styled" Windows10 Settings there is a message schown: "some settings are managed by your organization" and is greyd out.

I did some research and found out that this is the normal case for Domain-Clients, what makes perfect sense: Windows Server 2008 R2, no internet time tab

However, my computer is a DomainController which should provide the time for clients. Could it be that my DomainController is anyhow configured as both at a time, server and client?

This would also explain why i can't manage windows-updates on the domain-server.

Does anyone know how to fix this?

Picture of missing Tab (old style), Picture of greyd out elements (new Win10 Settings)

Solution

However, my computer is a domain controller which should provide the time for clients. Could it be that my domain controller is anyhow configured as both at a time, server and client?

The Domain Controller should be configured to sync time with an external time source, but that isn't done via the internet time tab like it is on non-domain clients. To sync the DC run the following from an elevated command prompt on the designated Primary Domain Controller Emulator:

w32tm /config /manualpeerlist:<peers> /syncfromflags:manual /reliable:yes /update

<peers> is a space-separated list of hostnames for NTP enclosed in double-quotes ". If using DNS names instead of IP addresses then add ,0x1 as a suffix to each name, e.g.:

w32tm /config /syncfromflags:manual /manualpeerlist:"0.pool.ntp.org,0x1 1.pool.ntp.org,0x1 2.pool.ntp.org,0x1 3.pool.ntp.org,0x1" /reliable:yes

---

https://blogs.technet.microsoft.com/industry_insiders/2006/08/29/windows-time-and-the-w32tm-service/

Comments

[manman]

thank you for the comment. but why is it, that also in the update-settings the domain-controller says "some settings are managed by your organization"? is the only way over gpo? ... its a really tiny AD so the way over systemsettings would be nice and easy anyhow.