What is Windows Time Service?

re: What is Windows Time Service?

Michael — Thu, 19 Jul 2007 16:47:43 GMT

Nice start. One thing that may be helpful is a list of a couple of quick things and settings that can be done. For example, setting the root DC to an external time source, what settings need to be configured in the registry. Another thing that would be nice is a guess on what to do when you see event 50 or 52 or any other common events. Also, maybe a thought when a problem occurs, maybe it is a w32tm issue or maybe a hardware issue.

re: What is Windows Time Service?

Ryan Sizemore — Thu, 19 Jul 2007 20:50:33 GMT

@Michael: There are quite a few topics that I didn't cover that I had hoped to, but I would rather not try to cram too much into the first post. I wanted the first post to be a general overview, to give everyone some sort of grounding on what w32time is and how it works at a very high level. There will be more to come for sure.

re: What is Windows Time Service?

occultations — Fri, 24 Aug 2007 15:09:20 GMT

An interesting article. But I don't understand the logical step that gets you to "((t4 - t1) - (t3 - t2)) is the clock offset between the two computers".

Consider the following scenario:

The client's clock is 10 seconds slow.

Let's say that T+n means n seconds past midnight.

The client makes a request at T+15 by the client's clock (T+25 in reality).

The request takes 3 seconds to get to the time source. It arrives at T+28.

The time source sends a reply 1 second later, at T+29.

The reply takes 2 seconds to get back to the client. It arrives at T+31, or T+21 by the client's clock.

So t1 is T+15, t2 is T+28, t3 is T+29, t4 is T+21. ((t4 - t1) - (t3 - t2)) is ((21-15) - (29-28)), which is 5 seconds. But the client's clock is 10 seconds slow.

What am I missing?

re: What is Windows Time Service?

Ryan Sizemore — Fri, 24 Aug 2007 23:54:15 GMT

Well, the problem here is that I was callous with the copy-and-paste. You might notice that the formula for calculating the offset is the same one for calculating the delay. Yea, right. The correct formula for clock offset is:

((t2 - t1) + (t3 - t4)) / 2

t1 = 00:00:15 (15 seconds after midnight, according to the client's clock)

[3 second transmission delay]

t2 = 00:00:28 (28 seconds after midnight, according to the server's clock)

[1 second processing delay]

t3 = 00:00:29 (29 seconds after midnight, according to the server's clock)

[2 second transmission delay]

t4 = 00:00:21 (21 seconds after midnight, according to the client's clock)

((t2 - t1) + (t3 - t4)) / 2

((28 - 15) + (29 - 21)) / 2

(13 + 8) / 2

21 / 2

=10.5

Why 10.5 instead of 10? One of the assumptions that NTP makes is the transmission delay is the same in both directions. For argument's sake, I left it the way you described, especially because in the real world assumptions fail all the time.

I hope this clears things up. Thanks for catching this occultations.

re: What is Windows Time Service?

occultations — Tue, 28 Aug 2007 20:41:04 GMT

That's more like it! I'm interested that NTP assumes the transmission delay is the same in both directions. It seems quite likely that there would be a systematic bias. Can NTP do anything about that?

I've also got a query about W32time. I've got a PC here on which W32time has spent a week trying to sync the time, but it keeps on overcorrecting. If you're interested, and you can let me know your email address, I'll send you some graphs.

Cheers,

Chris

re: What is Windows Time Service?

Ryan Sizemore — Mon, 03 Sep 2007 04:54:39 GMT

The issue with transmission delay is that there is no way to detect what the delay is in any one direction since you are dealing with two independent clocks. This is detailed in the NTP RFC linked at the top of the post.

If you have questions, you can start by asking them in the technet forums: http://forums.microsoft.com/TechNet/ShowForum.aspx?ForumID=722&SiteID=17

I will see your question there, and it is a better forums to help you with your specific issue.

re: What is Windows Time Service?

Andreas — Mon, 03 Sep 2007 17:29:49 GMT

You wrote that the value controlling when w32time skews or sets is adjustable in the registry (default is 5 min?). Please let us know the registry entries.

re: What is Windows Time Service?

Ryan Sizemore — Tue, 04 Sep 2007 01:51:34 GMT

The value that you are referring to is the value which Kerberos uses to determine if another machine is too far out of sync with to allow authentication. W32time time skews are a bit more complicated, and will be covered in an upcomming post. If you have questions about Kerberos, try posting a question in the Technet forum linked in my comment above.

re: What is Windows Time Service?

occultations — Wed, 12 Sep 2007 13:32:42 GMT

I have added a post at http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=2100204&SiteID=17 about W32Time overcorrecting. I hope you can have a look at it.