clock

Clock of a Windows, by WinRM

Returns how far the clock of a Windows is from a time server: the offset with its sign (positive, the clock is ahead; negative, it is behind) and the same offset without its sign, in seconds. One watch is proposed, set on the probe.

Versions

Windows Server 2012 and later, Windows 8 and later: Windows PowerShell 3.0, which the collector needs, ships with each of them; the WinRM service runs by default on every Windows Server from 2012 on, and winrm quickconfig starts it on a desktop Windows. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real Windows.

How it works

The collector runs one PowerShell script, by WinRM, that reads the clock of the Windows, then asks the time server named by the variable protocol:ntp:server for its time, by NTP. Without a value, the server is pool.ntp.org; an administrator who has a time server of his own sets it once, on the root of the tree.

[DateTime]::UtcNow.Ticks

• WinRM hands the script to PowerShell itself: no shell stands in between, and the script is the one of windows/ssh/clock, without the powershell -Command "…" that cmd.exe needs there. The default shell of an OpenSSH server does not matter here.
• The script returns the hundreds of nanoseconds since 1 January of the year 1 UTC, an integer, with no time zone and no culture to guess; every .NET serves it, that of Windows Server 2012 included.
• The poller notes its own clock before and after the WinRM call, and when the time server answers. The server's time is brought back to the middle of the WinRM call: the server's time, minus the time elapsed since then by the poller's clock. Neither the time between the two readings nor the error of the poller's own clock counts in the offset.
• The offset is the time of the Windows minus that reference, rounded to a tenth of a second; the offset without its sign is the one the watch judges.
• Nothing is skipped at the first run.
• When the time server does not answer, the collector stops as unreachable, with the message "Time server unreachable": it is the time server that failed, not the Windows.
• An answer that is not a number stops the collector as misconfigured.

Nothing is written to the Windows: the script only reads.

Prerequisites

• The WinRM service of Windows listening in HTTPS. The service runs by default on every Windows Server from 2012 on (on a desktop Windows, winrm quickconfig starts it), with an HTTP listener only; the HTTPS listener needs a certificate: - a certificate for server authentication in the store of the computer (Cert:\LocalMachine\My), bearing the name the poller connects to: issued by the authority of the company, or made on the server by New-SelfSignedCertificate -DnsName <name> -CertStoreLocation Cert:\LocalMachine\My from Windows Server 2012 R2 on (Windows Server 2012 does not have this command); - then the listener: winrm quickconfig -transport:https finds a certificate of an authority by itself, but refuses a self-signed one; the command that takes either, on every Windows from Server 2012 on, is winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="<name>";CertificateThumbprint="<thumbprint>"} in cmd.exe, the thumbprint being the one Windows shows for the certificate.
• The Windows firewall open to the poller on TCP 5986, which creating the listener does not do: New-NetFirewallRule -DisplayName "WinRM HTTPS" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow in PowerShell. A listener on another port is set in protocol:winrm:port.
• The certificate judged by the poller before the account is sent, by the TLS profile of the probe: issued by an authority the system of the poller knows, by an authority added in protocol:tls:authorities, or pinned in protocol:winrm:fingerprint, the way for a self-signed certificate; the pin is not needed when the Security settings trust the first WinRM fingerprint presented. The fingerprint is sha256: followed by the SHA-256 of the certificate in 64 lower-case hexadecimal characters; from a machine that reaches the port, openssl s_client -connect <name>:5986 </dev/null | openssl x509 -noout -fingerprint -sha256 prints it, in capitals, with colons to take off. A certificate whose name is not the address of the host is judged on the name set in protocol:tls:server-name.
• NTLM authentication, which the WinRM service accepts as installed (Negotiate = true in winrm get winrm/config/service/auth): the password never travels, only an answer computed with it. A domain that refuses NTLM is not served.
• Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
• An account for monitoring, without administrator rights, local or of the domain, set in protocol:winrm:user (account, DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the local group "Remote Management Users", which opens WinRM to an account that is not an administrator. No other group: the clock is open to any account.
• The poller able to reach the time server on UDP 123. A poller cut off from the internet needs protocol:ntp:server set to a time server it can reach.

Outputs

Watches

Limits

• A certificate of the listener that expires, or a pinned one that is renewed, stops every WinRM collector of the host: the network/tls/certificate collector of banshee/web-collection, deployed on port 5986, watches it.
• The offset is read to about one second: the WinRM call, connection, authentication and start of PowerShell included, is a second or two long, and the clock is read somewhere inside it. The default thresholds stay far above it.
• The time server is trusted: a time server that is itself wrong makes every clock look wrong. Point protocol:ntp:server at the server your machines synchronise with.