time

Time of a domain controller, by WinRM

Returns the offset of the clock of a domain controller from a time server, the role of the domain controller in the time hierarchy of the forest, and the time source its Windows Time service is set to follow. Two watches are proposed, both checked: a clock off, and a time source that is not the one its role calls for.

Versions

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later, as the prerequisites name them. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real domain controller.

How it works

Microsoft sets every computer of a domain to follow the domain hierarchy (NT5DS), with one exception: the domain controller that holds the PDC emulator role of the root domain of the forest, which follows an external time server (NTP), and from which the whole forest takes its time (Microsoft, "Windows Time service tools and settings"). That domain controller is the first to watch: its clock is the clock of the forest.

The collector runs one PowerShell script, by WinRM, then asks the time server of protocol:ntp:server for its time:

$ticks = [string][DateTime]::UtcNow.Ticks; $ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; $computer = Get-CimInstance Win32_ComputerSystem; $server = $computer.DNSHostName + '.' + $computer.Domain; $context = New-Object DirectoryServices.ActiveDirectory.DirectoryContext('DirectoryServer', $server); $dc = [DirectoryServices.ActiveDirectory.DomainController]::GetDomainController($context); $role = 'other'; if ($dc.Name -eq $dc.Forest.RootDomain.PdcRoleOwner.Name) { $role = 'root-pdc' }; $config = Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters; $policy = Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\W32Time\Parameters -ErrorAction SilentlyContinue; $type = $config.Type; $peers = $config.NtpServer; if ($policy.Type) { $type = $policy.Type; $peers = $policy.NtpServer }; ConvertTo-Json -Compress -InputObject @{ticks = $ticks; role = $role; type = $type; peers = $peers}

• WinRM hands the script to PowerShell itself: the script is the one of active-directory/ssh/time, without the powershell -Command "…" that cmd.exe needs there.
• The clock is read first, as [DateTime]::UtcNow.Ticks: the hundreds of nanoseconds since 1 January of the year 1 UTC, with no time zone and no culture to guess. The time of the server is brought back to the middle of the WinRM call, as the windows/winrm/clock collector of banshee/windows-collection does: the offset is read to about a second. Positive, the clock of the domain controller is ahead; negative, it is behind.
• The role is root-pdc when the domain controller is the PDC emulator of the root domain of the forest (Forest.RootDomain.PdcRoleOwner in .NET), other otherwise.
• The time source is the value Type of the Windows Time service, as Microsoft documents it under HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters: NT5DS (the domain hierarchy), NTP (the servers of NtpServer), AllSync (every mechanism), NoSync (none). A group policy writes its own values under HKLM\SOFTWARE\Policies\Microsoft\W32Time\Parameters, which then prevail: they are read first. peers is the value NtpServer beside the type, as written (time.example,0x8).
• "Time source unexpected" raises a warning when the PDC emulator of the root domain is not set to NTP, or when another domain controller is not set to NT5DS.
• The registry is read, not w32tm: Microsoft requires an administrator to run w32tm. The registry gives the source the service is set to, not the one it follows at this moment.
• A time server that does not answer stops the collector as unreachable; an answer of PowerShell that is not the expected JSON stops it as misconfigured.

Nothing is written to the Windows: the script only reads.

Prerequisites

• A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later.
• A time server the poller reaches on UDP 123, set in protocol:ntp:server.
• The WinRM service listening in HTTPS, on TCP 5986 or the port set in protocol:winrm:port, open in the Windows firewall to the poller, with a certificate the poller judges by the TLS profile of the probe or pins in protocol:winrm:fingerprint: the steps are those of the windows/winrm/services collector of banshee/windows-collection. NTLM authentication, which the WinRM service accepts as installed.
• An account of the domain for monitoring, without administrator rights, set in protocol:winrm:user (DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the group "Remote Management Users" of the domain (on a domain controller, the built-in group of the Builtin container). No other group: the keys of the Windows Time service are read in the registry.

Outputs

Watches

Kerberos refuses by default a clock more than 5 minutes off; the critical default is well below.

Limits

• AllSync on the PDC emulator of the root domain raises "Time source unexpected": it also follows the hierarchy. A forest that wants it unchecks the watch on that probe.
• A domain controller that holds the PDC emulator of a child domain follows the hierarchy too (NT5DS): it is other.
• Not yet checked on a real domain controller: the execution; that an account without administrator rights reads the keys of the Windows Time service in the registry; that Name of a DomainController and of a role owner are written alike (both DNS names).