Thanks to Windows Time Service, Win2K's time synchronization is much better than NT's
Clocks and calendars have been an annoyance on PCs since PCs appeared on the scene. On computers that ran early versions of DOS, you needed to type the time and date every time you started the system. That requirement got old very quickly and led to one of the earliest market opportunities for PC add-ons: the battery-powered clock and calendar. In 1984, manufacturers started producing PC motherboards that had onboard clocks and calendars, and clock and calendar circuits have been built in to PCs ever since.
But those built-in circuits aren't very accurate. A survey of a few dozen PCs in any office would probably reveal that the time on some PCs' clocks might be more than an hour different from the time that other PCs' clocks show, and all the computers' clocks might differ from the actual time. So, PC designers looked for more accurate and centralized time sources.
Network servers are an obvious place to keep a central time source. For years, Novell NetWare servers have automatically synchronized the time on all client computers that logged on to the server, but Microsoft products haven't done anything like that—at least, not by default. If you know a few tricks (which I discuss later), you can make Windows NT workstations synchronize their clocks with an NT server's clock, but the technique isn't well known. Furthermore, you can't synchronize an NT workstation's time to a server's time without modifying the user's default rights on the workstation.
Modern Times
Windows 2000 fixes NT's lack of time synchronization by implementing a new built-in system called Windows Time Service. This system requires almost no administration. Workstations that run Win2K Professional and member servers that run some version of Win2K Server set their system time and date to a time and date that the domain controller (DC) that authenticates the workstation or member server provides. But the workstation or server doesn't synchronize its clock to the DC's clock only at authentication time; the workstation or server resynchronizes its clock approximately every 8 hours or whenever someone logs on.
For their part, the domain's DCs synchronize their time to one particular DC in the domain that uses the Flexible Single-Master Operation (FSMO, aka Operations Master) PDC emulator role. By default, the PDC emulator FSMO is the first DC that you install in a domain. But what does each domain's PDC emulator FSMO synchronize its time with? It synchronizes with the PDC emulator FSMO of the first domain that you created in the forest (i.e., the DC that acts as a PDC emulator FSMO in the forest root domain). That forest root machine thus acts as the master clock and calendar for your entire Active Directory (AD) forest. (For those who are wondering, yes, that master timekeeper does understand time zones.)
Your question now probably is, How do I keep the top-dog master-clock computer, the forest root's PDC emulator FSMO, in sync with time in the real world? The answer is that you type in the command
net time /setsntp:
<servername>
Net Time's /setsntp option reveals that the command uses the Simple Network Time Protocol (SNTP), a standard Internet protocol. (Internet Engineering Task Force—IETF—Request for Comments—RFC—2030, dated October 1996, defines SNTP.) You can point your forest root's PDC emulator FSMO to any SNTP time server on the Internet and force the FSMO to keep its time in lockstep with that time server. Many firewall products include a time server, so your FSMO might not need to leave your intranet to synchronize with the SNTP time server. But if you do need to adjust your firewall, you might find it helpful to know that SNTP uses UDP port 123.
Finding the Time
Where do you find an SNTP server? In the United States, the navy is the official national timekeeper and runs a set of time servers, including the aptly named tick.usno.navy.mil and tock.usno.navy .mil. In my experience, most ISPs' DNS servers also seem to be SNTP servers. So, if one of your ISP's DNS servers were named ns2.bigisp.com, you could type the command
net time /setsntp:ns2.bigisp.com
to cause your FSMO to sync with that DNS server.
The Microsoft documentation about the Net Time /setsntp command says that you can specify a list of servers in the command. And you can, but with a trick: Enclose the list in quotation marks, and separate server names with a space. For example, to tell your server to look for the time first at www.acme.com and then, if necessary, at www.apex.com, you'd type
net time /setsntp:"www.acme.com www.apex.com"
If you want to use an external time source, you might like to first check that a time server exists where you expect it to. The Microsoft documentation says that you need only type Net Time to see the time on your SNTP server, but that method hasn't worked for me. To actually see what Windows Time Service does on your system, you can use the W32tm command-line tool. But first, you need to type the command
net stop w32time
to stop Windows Time Service. You can then try out your time source by typing
w32tm -once
to set the time from the time source just once (W32tm's default is to update the time regularly). The command spits out about a page of cryptic output; when the command succeeds, one of the lines will read Recv'ed from server 48 Bytes.... When you're finished, don't forget to type
net start w32time
to restart the time service.