Question Locked

Change System Time Problem

0 helpful
13 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We use a logon script to synchronize our XP workstations with a NT server. When any domain user logs in to the domain the script runs. Until recently I just assumed everything was good. One of our XP workstations was 15 min off.

When a user without admin rights logs onto this workstation (call it XP1) the script doesn't reset the time. Of course if you have admin rights on the domain it does. Now on the workstation next to it (call it XP2) the logon script runs fine and the time is synchronized for any domain user.

OK, so next I look in 'Administrative Tools' => 'Local Security Policy' => 'Local Policies' => 'User Rights Assignments' => 'Change the System Time'. The values in both XP1 and XP2 are Administrators, Power Users. This seems to be the default setting. Fine, but the non administrator can change the time on XP2 and not on XP1!

Is there another setting I'm missing? I've been googling for it but keep coming back to the Change System Time setting. My boss doesn't really want to allow users the permission. We are looking at other ways to synchronize the workstations.

BTW: Yes, I rebooted XP1 just for fun. Looking in Network Places on XP1 you can see the network just fine. The NT permissions on the server script are Everyone - Read.

13 replies

by cg it

If their exactly the same configuration,and members of the same NT domain, it should work.

The logon script should run. if you have the script in computer settings might try it in user settings. see if that makes a difference.

by locolobo

We have an application that is in the process of being upgraded. The old version runs on NT but not on 2003 Server. Everybody has to use this application. So for now I have 2 networks in the same building. A small 2003 network, and a larger (75 machines) NT server, XP workstation network.

Thanks for your reply. On my way home last night I had one of those "DOH" moments. The non admin user is a power user on XP2. I put his group in the power users on XP2. Should have remembered it. Checking things out this morning it appears that the logon script isn't running on other XP workstations around the building either. I think I'm going to change my logon here to "Goober" or "Homer". Not really.

The XP workstations are trying to synchronize but of course they don't belong to an AD domain yet so there is a problem. Your comments make me think about doing this another way. Put the logon script in the computer settings for each XP machine. If needed set it up as a task that runs each night.

by cg it

why not just use internet time. I believe net time service for NT SP4 uses the same time service as W2K. Really rusty on NT so I might be off on time service for NT.

but if you use net time from an internet source and all use the same time source like time.windows.com or time.nist.gov. think that would solve the problem.

That is if they have access to the internet.

I doubt the differences in time snyc would be more than a few minutes...

Have to look up time service again on NT [still have those old books around here somewhere]

by rob miners

I found this article.

NET TIME is a foreground command-line task that must be manually run (or scheduled) in order to set the time. In most cases, it requires that each workstation have a batch file or use a login script of some sort to get the time. This means that the time only gets synchronized if the machine successfully logs in to the NT domain AND the login script runs correctly. Unfortunately, these are not foregone conditions on all systems - as you will undoubtably know if you've worked with login scripts before. In addition, NET TIME suffers from other serious limitations:

On Windows NT4/2K/XP/2003/Vista/2008 workstations, the logged-in user must have special rights on the local machine in order to set the time using NET TIME
This is also true of most other time products as well. The local system policies must specifically grant the named user time setting rights or the time sync will fail. Setting and maintaining these rights for Windows NT4/2K/XP/2003/Vista/2008 workstations is very time-intensive for an administrator.

Machines without a time service that do not have a logged-in user cannot synchronize their time.
Some PC clocks (even ones right off the assembly-line) gain or lose several minutes a day. If a machine goes even a weekend without a logged-in user, it can have significant time errors.

NET TIME users at different locations must use different command lines.
Because NET TIME requires a fixed server name in order to use a local server other than the PDC, moving a user to a different office or even network segment can require a reconfiguration of their login or batch files to ensure they get their time from the correct server. Also, see the time zone issues above.

NET TIME doesn't know about network delays and PC clocks.
NET TIME uses Lan Manager protocols that do not take network delays and WANs into account. A workstation synchronizing to a remote server over a slow link can be off by several minutes or more.

NET TIME behaves differently on Windows NT4/2K/XP/2003/Vista/2008 and Win3x/95/98 in how it handles time zones.
On Windows NT4/2K/XP/2003/Vista/2008, if the server that gets contacted is in a different time zone than the client, the server's time is displayed in the time zone of the client (in other words if I'm in Pacific Time on my NT machine, but I happen to authenticate with a server in the Eastern Time zone, the time on my local machine will be set to Pacific time). However, on Win 3.x,95 and 98 machines in the Pacific time zone syncing to an Eastern time zone server would have their time set to Eastern time.

If you are using the /domain option with NET TIME, any other servers running Domain Time Server can service a time request. However, if using a WAN and a local server becomes unavailable (or just slow) for some reason, machines using NET TIME can get their time changed to a different zone if a server in another time zone answers. NET TIME just doesn't know any better.

NET TIME cannot find or use alternate servers if the specified server is unavailable.
NET TIME is a one-server product (with the exception of Domain Time servers running on DCs). If the server specified on the command-line (i.e. in a batch file) is unavailable, the time synchronization will fail.

NET TIME with the /domain option requires the workstation to contact the PDC.
When you run NET TIME without the /domain option, the workstation will iterate through the list of time sources on the network, and contact the first one encountered. By default on an NT or 2000 network, only the PDC is a time source. However, if Domain Time Server is installed on any machine, that machine also becomes a time source. Notice that the NET TIME client won't use the nearest time source -- it will use the first one found in the browser list. It also will not move on to the next source if the first one fails.

Regardless of which time source NET TIME uses, it can take an extended period of time for the NetRemoteTOD call to fail or succeed, and NET TIME does not account for network latencies. In addition, if the NET TIME client happens to be Win95 or Win98, and the time source's time zone settings do not match the client's, the client's time will be wrong.

NET TIME doesn't work well with laptops and remote offices.
The login script problems mentioned above are magnified dramatically if you're using a laptop or workstation remotely, since the workstation may or may not actually authenticate with an NT domain when dialing in (if you're using a PPP dial-in service, or over the Internet using a third-party VPN, for example).

Also, a workstation with a NET TIME command scheduled to run on a schedule (such as the NT AT command) can cause a system using Dial-Up networking to attempt to dial the remote network when it tries to run.

http://www.greyware.com/software/domaintime/product/w32time.asp

by locolobo

Yes our logon script is using NET TIME. It was running perfectly on NT. We did have some issues when we originally set it up years ago but I can't remember them. Maybe we gave everybody the right to "Change System Time" on each NT workstation.

After going over things again I realized that the non admin user was a power user on XP2. Hence his logon script worked on XP2 but not on XP1. Checking around it looks like other XP workstations are having the same problem. So I'm looking at solving the time synchronization problem another way.

The time doesn't have to be synchronized to the second. We don't notice it until the Workstation Application Server gap is more than about 5 min. What happens then is the app server picks up jobs from the workstation and lets them pile up because their time is in the future. When the app server catches up it starts working on the samples. In the mean time the extra jobs on the list clogs the app server and sometimes it bogs down.

I should have checked the time synchronicity when we upgraded from NT workstations to XP. But everywhere I looked the XP workstations were good so I assumed everything was good.

Thanks for the info and link. It will come in useful.

by rob miners

went straight from NT4 with win98 to 2003 and win98, XP. :)

by locolobo

We started doing this 5-6 years ago when we were all NT. Our original solution was to install Atomic Clock on the application server. Then we created a logon script using Net Time on the PDC that synchronized the workstations to the app server. We did have some problems. We probably set all NT machines so that any user could reset the system clock. Then we forgot about it.

When we upgraded the workstations to XP I did check but everywhere I looked the XP workstations had the correct time. But I haven't checked in 2-3 years. The upgrade was phased over several years for several reasons. Anyway until we ran into another problem a couple of days ago nobody knew there was a problem. Upon talking to the user on that particular workstation we found out it's clock has been off for several months!

But that's my plan is to check the system clocks and make sure they are set to synchronize over the internet. This should be work.

Thanks for the suggestions. We still have our NT books too. Looking forward to finishing this upgrade and bringing our domain into the 21st century. maybe?
:)

by cg it

I've done some migrations and it's not pretty.

by locolobo

Actually as we progressed it became clearer that we were going to need to test the new app on a 2003 domain while leaving everybody else on the NT domain. The funny thing is we're running Exchange 2003 on the new domain. People log onto the NT domain but Outlook connects to the Exchange Server on the AD domain. Yes there are small problems here and there.

by mjd420nova

I've seen all kinds of strange problems erupt from a bad, failing or dead CMOS battery. Some of the faults don't even seem to be related to a CMOS failure but it can create some very wierd problems.

by locolobo

that might explain some things. Checking other XP machines the system clocks are set to synchronize over the internet. But for some reason this one wasn't. It has connectivity.

I'll have to look at my logs but this particular machine may have had motherboard problems a few years ago. It was under warranty then and the vendor fixed it rather than replacing the motherboard.

by cg it

you probably could get by with NT as a terminal server and member server of the W2003 domain.... heck with migration or upgrades...

This discussion is closed to new replies.