banshee/active-directory-collection/active-directory/ssh/time

Time of a domain controller, by SSH

Returns the offset of the clock of a domain controller from a time server, the role of the domain controller in the time hierarchy of the forest, and the time source its Windows Time service is set to follow. Two watches are proposed, both checked: a clock off, and a time source that is not the one its role calls for.

Versions

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later, as the prerequisites name them. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real domain controller.

How it works

Microsoft sets every computer of a domain to follow the domain hierarchy (NT5DS), with one exception: the domain controller that holds the PDC emulator role of the root domain of the forest, which follows an external time server (NTP), and from which the whole forest takes its time (Microsoft, "Windows Time service tools and settings"). That domain controller is the first to watch: its clock is the clock of the forest.

The collector runs one PowerShell command, then asks the time server of protocol:ntp:server for its time:

powershell -NoProfile -NonInteractive -Command "$ticks = [string][DateTime]::UtcNow.Ticks; $ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; $computer = Get-CimInstance Win32_ComputerSystem; $server = $computer.DNSHostName + '.' + $computer.Domain; $context = New-Object DirectoryServices.ActiveDirectory.DirectoryContext('DirectoryServer', $server); $dc = [DirectoryServices.ActiveDirectory.DomainController]::GetDomainController($context); $role = 'other'; if ($dc.Name -eq $dc.Forest.RootDomain.PdcRoleOwner.Name) { $role = 'root-pdc' }; $config = Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters; $policy = Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\W32Time\Parameters -ErrorAction SilentlyContinue; $type = $config.Type; $peers = $config.NtpServer; if ($policy.Type) { $type = $policy.Type; $peers = $policy.NtpServer }; ConvertTo-Json -Compress -InputObject @{ticks = $ticks; role = $role; type = $type; peers = $peers}"

The clock is read first, as [DateTime]::UtcNow.Ticks: the hundreds of nanoseconds since 1 January of the year 1 UTC, with no time zone and no culture to guess. The time of the server is brought back to the middle of the SSH call, as the windows/ssh/clock collector of banshee/windows-collection does: the offset is read to about a second. Positive, the clock of the domain controller is ahead; negative, it is behind.
The role is root-pdc when the domain controller is the PDC emulator of the root domain of the forest (Forest.RootDomain.PdcRoleOwner in .NET), other otherwise.
The time source is the value Type of the Windows Time service, as Microsoft documents it under HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters: NT5DS (the domain hierarchy), NTP (the servers of NtpServer), AllSync (every mechanism), NoSync (none). A group policy writes its own values under HKLM\SOFTWARE\Policies\Microsoft\W32Time\Parameters, which then prevail: they are read first. peers is the value NtpServer beside the type, as written (time.example,0x8).
"Time source unexpected" raises a warning when the PDC emulator of the root domain is not set to NTP, or when another domain controller is not set to NT5DS.
The registry is read, not w32tm: Microsoft requires an administrator to run w32tm. The registry gives the source the service is set to, not the one it follows at this moment.
A time server that does not answer stops the collector as unreachable; an answer of PowerShell that is not the expected JSON stops it as misconfigured.

Nothing is written to the Windows: the command only reads.

Prerequisites

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later.
A time server the poller reaches on UDP 123, set in protocol:ntp:server.
The OpenSSH server of Windows, installed and started, its default shell left at cmd.exe, the Windows firewall open to the poller on TCP 22, and the fingerprint of its host key set in protocol:ssh:fingerprint unless the Security settings trust the first SSH fingerprint presented: the steps are those of the windows/ssh/services collector of banshee/windows-collection.
An account of the domain for monitoring, without administrator rights, set in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key. No group: the keys of the Windows Time service are read in the registry.

Outputs

Name	Label	Unit	Per instance
`offset`	Offset from the time server	s	no
`drift`	Offset, without its sign	s	no
`role`	Role in the time hierarchy	—	no: `root-pdc` or `other`
`type`	Time source type	—	no
`peers`	Time servers set	—	no

Watches

Name	Title	Kind	Defaults	Checked by default
`clock-drift`	Clock off	high threshold, on `drift`	warning above 5 s, critical above 60 s	yes
`source`	Time source unexpected	judged by the collector	warning when the type does not match the role	yes

Kerberos refuses by default a clock more than 5 minutes off; the critical default is well below.

Limits

AllSync on the PDC emulator of the root domain raises "Time source unexpected": it also follows the hierarchy. A forest that wants it unchecks the watch on that probe.
A domain controller that holds the PDC emulator of a child domain follows the hierarchy too (NT5DS): it is other.
Not yet checked on a real domain controller: the execution; that an account without administrator rights reads the keys of the Windows Time service in the registry; that Name of a DomainController and of a role owner are written alike (both DNS names); which right lets an account that is not an administrator open an SSH session on a domain controller.