Re: W32Time Errors

"Brandon Schultz" <> wrote in message
news:4497905b-f810-4b11-b529-...
> We are running a Windows 2000 domain with a mix of 2000 Pro and XP
> machines. Recently W32Time on all of the XP machines started throwing
> up Events 24 & 29 in the System logs:
>
> Event 24, Warning:
> Time Provider NtpClient: No valid response has been received from
> domain controller dc.domain.com after 8 attempts to contact it. This
> domain controller will be discarded as a time source and NtpClient
> will attempt to discover a new domain controller from which to
> synchronize.
>
> Event 29, Error:
> The time provider NtpClient is configured to acquire time from one or
> more time sources, however none of the sources are currently
> accessible. No attempt to contact a source will be made for 15
> minutes. NtpClient has no source of accurate time.
>
> Every XP machine gets these every hour, ad infinitum. I have tried
> executing "w32tm /resync /rediscover", but I get "The computer did not
> resync because no time data was available." The Windows 2000 machines
> do not show these events. The PDC is getting time from NTP server
> pool, and I have verified that it is getting time correctly, but these
> XP machines won't sync time to this 2000 controller.
>
> I have searched everywhere for an answer to no avail. Anyone have any
> ideas?


Is the Time service running on the 2000 machine? Are there any ports being
blocked between the clients and PDC Emulator?

Are the client machines (and DC itself), using only the internal DNS, or is
there an ISP's, external DNS, or the router being used as a DNS server?

Does the DC have more than one NIC, IP address, or is RRAS installed on it?

The following is how to set time on a PDC Emulator in a 2000 domain:
---
For Windows 2000 domains:

On the PDC Emulator, run the following three commands and what to expect as
responses. I used 192.5.41.41, which is a Washington, DC time server, but
you can use any that you want. I posted a link at the bottom with a complete
list. Just make sure UDP 123 is opened to the PDC Emulator, and the time
service is running on the server:

C:\>net time /setsntp:192.5.41.41
The command completed successfully.

C:\>net stop w32time
The Windows Time service is stopping.
The Windows Time service was stopped successfully.

C:\>w32tm -once
(W32time performs numerous commands to set the time)

C:\>net start w32time
The Windows Time service is starting.
The Windows Time service was started successfully.
---

A list of the Simple Network Time Protocol (SNTP) time servers ...For more
information about the use of time services in Windows Server and Windows NT,
click the following article numbers to view the articles in the ...
http://support.microsoft.com/kb/262680

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum to benefit from collaboration
among responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

"Brandon Schultz" <> wrote in message
news:e50e14d3-3999-4d3b-991f-...
Hi Ace,

Yes, the time service is running on the Windows 2000 PDC and there are
no ports blocking the clients from the PDCe. Netstat -a shows UDP port
for ntp *:*

All of the client machines are using internal DNS, which is setup to
use forwarders for the outside world.

The PDCe DC does have two NIC's in it that are teamed using a Broadcom
driver. It has one single IP. RRAS is installed.

The PDCe DC will get external time correctly. I have used "Net time /
setsntpool.ntp.org" and verified from our ISA server that it is
coming and going correctly.

Here's a test I setup this morning in a VM network:

1. I setup a Windows 2000 Domain.
2. I setup a Windows XP client
3. After joining the XP client to the domain I ran "w32tm /resync /
rediscover" and it immediately succeeded.
4. I ran netmon on the test DC and saw the NTP packets come through
from this test client.
5. I performed the exact same test in our production network and I
never see the NTP packets hit the PDCe.

So, I then proceeded to turn on debugging for W32Time on XP client in
the production network. Here's a piece of the log. I have changed the
actual name of the PDC to pdcdc.domain.com:

149236 15:47:45.4218750s - Polling peer pdcdc.domain.com (ntp.d|
192.168.56.1:123->192.158.0.100:123)
149236 15:47:45.4218750s - Sending packet to pdcdc.domain.com (ntp.d|
192.168.56.1:123->192.158.0.100:123) in Win2K detect mode, stage 1.
149236 15:47:45.4218750s - No response from peer pdcdc.domain.com
(ntp.d|192.168.56.1:123->192.158.0.100:123).
149236 15:47:45.4218750s - 5 Age:5 Ofs:+00.0000000s Dly:+00.0000000s
RDly:+00.0000000s Dsp:16.0000000s RDsp:00.0000000s Dst:16.0000000s
FDsp:08.0000000s
149236 15:47:45.4218750s - 4 Age:4 Ofs:+00.0000000s Dly:+00.0000000s
RDly:+00.0000000s Dsp:16.0000000s RDsp:00.0000000s Dst:16.0000000s
FDsp:12.0000000s
149236 15:47:45.4218750s - 3 Age:3 Ofs:+00.0000000s Dly:+00.0000000s
RDly:+00.0000000s Dsp:16.0000000s RDsp:00.0000000s Dst:16.0000000s
FDsp:14.0000000s
149236 15:47:45.4218750s - 2 Age:2 Ofs:+00.0000000s Dly:+00.0000000s
RDly:+00.0000000s Dsp:16.0000000s RDsp:00.0000000s Dst:16.0000000s
FDsp:15.0000000s
149236 15:47:45.4218750s - 1 Age:1 Ofs:+00.0000000s Dly:+00.0000000s
RDly:+00.0000000s Dsp:16.0000000s RDsp:00.0000000s Dst:16.0000000s
FDsp:15.5000000s
149236 15:47:45.4218750s - 0 Age:0 Ofs:+00.0000000s Dly:+00.0000000s
RDly:+00.0000000s Dsp:16.0000000s RDsp:00.0000000s Dst:16.0000000s
FDsp:15.7500000s
149236 15:47:45.4218750s - Peer poll: Max:32.0000000s Cur:00.0000000s
149236 15:47:45.4218750s - PeerPollingThread: waiting 32.000s
149236 15:48:17.4375000s - PeerPollingThread: WaitTimeout
149236 15:48:17.4375000s - Polling peer pdcdc.domain.com (ntp.d|
192.158.0.121:123->192.158.0.100:123)
149236 15:48:17.4375000s - Sending packet to pdcdc.domain.com (ntp.d|
192.158.0.121:123->192.158.0.100:123) in Win2K detect mode, stage 1.
149236 15:48:17.4375000s - *** DomHier Peer timed out - other paths
remain.
149236 15:48:17.4375000s - Polling peer pdcdc.domain.com (ntp.d|
192.168.56.1:123->192.158.0.100:123)
149236 15:48:17.4375000s - Sending packet to pdcdc.domain.com (ntp.d|
192.168.56.1:123->192.158.0.100:123) in Win2K detect mode, stage 1.
149236 15:48:17.4375000s - *** Last DomHier Peer timed out -
Rediscovery 1 will be in 15 minutes.
149236 15:48:17.4375000s - Logging warning: NtpClient: No response has
been received from domain controller pdcdc.domain.com after 8 attempts
to contact it. This domain controller will be discarded as a time
source and NtpClient will attempt to discover a new domain controller
from which to synchronize.
149236 15:48:17.4375000s - Logging error: NtpClient has been
configured to acquire time from one or more time sources, however none
of the sources are currently accessible and no attempt to contact a
source will be made for 15 minutes. NTPCLIENT HAS NO SOURCE OF
ACCURATE TIME.
149236 15:48:17.4375000s - PeerPollingThread: waiting 900.000s
149236 15:48:24.7187500s - RPC Caller is JDCINC\Brandon.Schultz
(S-1-5-21-1659004503-1757981266-682003330-1109)
149236 15:48:24.7187500s - RPC Call - HardResync
149236 15:48:24.7187500s - W32TmServiceMain: ********** Time Slip
Notification **********
149236 15:48:24.7187500s - ClockDispln:149236 15:48:24.7187500s -
ClockDispln TimeSlip:149236 15:48:24.7187500s - LI:3 S:0 RDl:0 RDs:0
TSF:0x0
149236 15:48:24.7187500s - TimeProvCommand([NtpClient],
TPC_TimeJumped) called.
149236 15:48:24.7187500s - TimeProvCommand([NtpServer],
TPC_TimeJumped) called.
149236 15:48:24.7187500s - W32TmServiceMain: waiting i16.000s
(1024.000s)
149236 15:48:24.7187500s - PeerPollingThread: PeerListUpdated
149236 15:48:24.7187500s - PeerPollingThread: waiting 892.719s
149236 15:48:40.7187500s - W32TmServiceMain: timeout
149236 15:48:40.7187500s - TimeProvCommand([NtpClient],
TPC_GetSamples) called.
149236 15:48:40.7187500s - NtpClient returned 0 samples.
149236 15:48:40.7187500s - W32TmServiceMain: waiting 1024.000s
149236 15:57:02.8593750s - W32TimeHandler called: SERVICE_CONTROL_STOP
149236 15:57:02.8593750s - Service shutdown initiated with exit code:
0.
149236 15:57:02.8593750s - ClockDisciplineThread: hShutDownEvent
signaled. Exiting.
149236 15:57:02.8593750s - Stopping 'NtpClient', dll:'C:\WINDOWS
\system32\w32time.dll'
149236 15:57:02.8593750s - NtpTimeProvClose([NtpClient]) called.
149236 15:57:02.8593750s - PeerPollingThread: waiting forever
149236 15:57:02.8593750s - Stopping 'NtpServer', dll:'C:\WINDOWS
\system32\w32time.dll'
149236 15:57:02.8593750s - NtpTimeProvClose([NtpServer]) called.
149236 15:57:02.8593750s - PeerPollingThread: PeerListUpdated
149236 15:57:02.8593750s - PeerPollingThread: waiting forever
149236 15:57:02.8593750s - PeerPollingThread: waiting forever
149236 15:57:02.8593750s - ListeningThread: StopEvent
149236 15:57:02.8593750s - Exiting ServiceShutdown
149236 15:57:02.8593750s - ---------- Log File Closed
-----------------

Any ideas?

Thanks,

Brandon Schultz

=========================================
Hi Brandon,

I see in the logs the following, which appears to tell me there are multiple
subnets? Can you confirm or elaborate, please?
---
192.168.56.1:123->192.158.0.100:123)
149236 15:47:45.4218750s - Sending packet to pdcdc.domain.com (ntp.d|
192.168.56.1:123->192.158.0.100:123) in Win2K detect mode, stage 1.
149236 15:47:45.4218750s - No response from peer pdcdc.domain.com
(ntp.d|192.168.56.1:123->192.158.0.100:123).
---

If this DC has RRAS on it (teaming is good, and not a factor), then the RRAS
interface is regsitering an unwanted IP, which the client may be resolving
to, and there's no route to that IP.

If this is the case, it's one of the reasons to not put RRAS on a DC.

Ace

"Brandon Schultz" <> wrote in message
news:d695f900-c2a0-4aa2-9686-...


Yes, I can elaborate. That subnet belongs to an installation of Sun's
Virtual Box. It's installed just on that sample XP client. The other
machines do not show that subnet, only 192.158.0.x. The problem
persists and I'm not sure why.

Brandon

=================

From the XP machine, when you ping pdcdc.domain.com, what IP returns?
How about using nslookup? Run nslookup in interactive mode, and keep
repeating the query by hitting arrow up, enter. Does it return the same IP
or a different IP each time?

In DNS, how many IPs show up for "pdcdc.domain.com?"

OT:
Also, it appears that you;re posting through Google Groups. For some reason,
and I think it's because Google Groups forces "Quotable Printable" as the
news posting setting, whenever I reply, it does not prefix ">" to your
posting. And it only happens with Google Group posts. Unfortunately that's
why you're seeing my replies like this.

Ace

"Brandon Schultz" <> wrote in message
news:7d44d2b9-89a1-436d-ae5f-...
On Aug 7, 6:05 pm, "Ace Fekay [MCT]" <ace...@mvps.RemoveThisPart.org>
wrote:
> "Brandon Schultz" <schultz.bran...@gmail.com> wrote in message
>
> news:d695f900-c2a0-4aa2-9686-...
>
> Yes, I can elaborate. That subnet belongs to an installation of Sun's
> Virtual Box. It's installed just on that sample XP client. The other
> machines do not show that subnet, only 192.158.0.x. The problem
> persists and I'm not sure why.
>
> Brandon
>
> =================
>
> From the XP machine, when you ping pdcdc.domain.com, what IP returns?
> How about using nslookup? Run nslookup in interactive mode, and keep
> repeating the query by hitting arrow up, enter. Does it return the same IP
> or a different IP each time?
>
> In DNS, how many IPs show up for "pdcdc.domain.com?"
>
> OT:
> Also, it appears that you;re posting through Google Groups. For some
> reason,
> and I think it's because Google Groups forces "Quotable Printable" as the
> news posting setting, whenever I reply, it does not prefix ">" to your
> posting. And it only happens with Google Group posts. Unfortunately that's
> why you're seeing my replies like this.
>
> Ace

Yes, I'm using Google Groups. I figured out the problem, but I wanted
to say thank you for taking the time to answer the posts. Here's what
it was: our layer 3 switches have a feature called DOS attack
suppression. These settings were turned on and it caused all UDP
packets below a certain size threshold to be dropped; as an aside, I
suppose that's the reason the 2k clients worked: the UDP packets look
different when you're watching them through Wireshark. Anyway, I
installed the latest firmware to the switches a couple weeks before I
noticed the issue, so I didn't correlate the problem with the firmware
-- this also explains why I could not find any information on my exact
issue anywhere on the net. Again, thank you for your posts; you were
more willingly helpful than anyone, anywhere.


=================

Interesting. Can you post the switch brand, model and the firmware you
installed that caused this? It may hopefully help others that may come
across the same problem. It's probably happened to others, but no one ever
posted the issue or the resolution. Your post may help someone, someday!

Also, no problem for the help. I was trying to eliminate basic
configuration, resolution, etc, to figure it out. I'm glad you got to the
bottom of it.

Ace

"Brandon Schultz" <> wrote in message
news:cc45a2f7-ac81-4ace-99c3-...
On Aug 12, 2:46 pm, "Ace Fekay [MCT]" <ace...@mvps.RemoveThisPart.org>
wrote:
> "Brandon Schultz" <schultz.bran...@gmail.com> wrote in message
>
> news:7d44d2b9-89a1-436d-ae5f-...
> On Aug 7, 6:05 pm, "Ace Fekay [MCT]" <ace...@mvps.RemoveThisPart.org>
> wrote:
>
>
>
>
>
> > "Brandon Schultz" <schultz.bran...@gmail.com> wrote in message
>
> >news:d695f900-c2a0-4aa2-9686-...
>
> > Yes, I can elaborate. That subnet belongs to an installation of Sun's
> > Virtual Box. It's installed just on that sample XP client. The other
> > machines do not show that subnet, only 192.158.0.x. The problem
> > persists and I'm not sure why.
>
> > Brandon
>
> > =================
>
> > From the XP machine, when you ping pdcdc.domain.com, what IP returns?
> > How about using nslookup? Run nslookup in interactive mode, and keep
> > repeating the query by hitting arrow up, enter. Does it return the same
> > IP
> > or a different IP each time?
>
> > In DNS, how many IPs show up for "pdcdc.domain.com?"
>
> > OT:
> > Also, it appears that you;re posting through Google Groups. For some
> > reason,
> > and I think it's because Google Groups forces "Quotable Printable" as
> > the
> > news posting setting, whenever I reply, it does not prefix ">" to your
> > posting. And it only happens with Google Group posts. Unfortunately
> > that's
> > why you're seeing my replies like this.
>
> > Ace
>
> Yes, I'm using Google Groups. I figured out the problem, but I wanted
> to say thank you for taking the time to answer the posts. Here's what
> it was: our layer 3 switches have a feature called DOS attack
> suppression. These settings were turned on and it caused all UDP
> packets below a certain size threshold to be dropped; as an aside, I
> suppose that's the reason the 2k clients worked: the UDP packets look
> different when you're watching them through Wireshark. Anyway, I
> installed the latest firmware to the switches a couple weeks before I
> noticed the issue, so I didn't correlate the problem with the firmware
> -- this also explains why I could not find any information on my exact
> issue anywhere on the net. Again, thank you for your posts; you were
> more willingly helpful than anyone, anywhere.
>
> =================
>
> Interesting. Can you post the switch brand, model and the firmware you
> installed that caused this? It may hopefully help others that may come
> across the same problem. It's probably happened to others, but no one ever
> posted the issue or the resolution. Your post may help someone, someday!
>
> Also, no problem for the help. I was trying to eliminate basic
> configuration, resolution, etc, to figure it out. I'm glad you got to the
> bottom of it.
>
> Ace

Good idea. We are using a stack of Dell PowerConnects -- 6248 and
6224. Firmware version: 3.0.0.8.

Thanks again,

Brandon


============

Thank you for posting it. I hope it helps others!

And you are welcome for the help.

Ace