After our office upgraded to Windows 10, time sync stopped working with the Windows workstations. This used to work fine with Windows 7 and still works with linux domain members (although that's not surprising). The Windows 10 workstations ended up operating off the CMOS clock. We didn't notice this for a long time since the CMOS clock drift is slow, but after several months users started noticing up to +/-6 minutes difference between their computers and the *real* time. Going to 'Date & Time settings > Sync Now' always gives "Time synchronization failed". For Windows 7 workstations, several years ago, I followed the advice in https://www.meinbergglobal.com/english/info/ntp-w32time.htm which was to do the following on the Windows 7 workstations: w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL w32tm /config /update Check the configuration: w32tm /query /source This worked and time was in-sync on the WIN7 computers for many years. I did this after upgrading/installing each Windows 10 workstation during 2019 Q4 and 2020 Q1, but apparently that didn't work. For the Windows 10 workstations I create the "Time Source" group policy per the instructions in https://wiki.samba.org/index.php/Time_Synchronisation. That didn't help either. Is it possible that the version of Samba I am using (Version 4.8.2) is too old for Windows 10? I could upgrade to 4.13.2, but that is in the "experimental" release of Slackware and may or may not install properly. I'll certainly try the newer version if list experts think that could help. But if time sync has nothing to do with any Samba services I won't waste my time upgrading. Advice? THX --Mark
On Wed, 18 Nov 2020, Mark Foley via samba wrote:> After our office upgraded to Windows 10, time sync stopped working with the Windows > workstations. This used to work fine with Windows 7 and still works with linux domain members > (although that's not surprising). > > The Windows 10 workstations ended up operating off the CMOS clock. We didn't notice this for a long > time since the CMOS clock drift is slow, but after several months users started noticing up to > +/-6 minutes difference between their computers and the *real* time. > > Going to 'Date & Time settings > Sync Now' always gives "Time synchronization failed". > > For Windows 7 workstations, several years ago, I followed the advice in > https://www.meinbergglobal.com/english/info/ntp-w32time.htm which was to do the following on > the Windows 7 workstations: > > > w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL > w32tm /config /update > > Check the configuration: > > w32tm /query /source > > This worked and time was in-sync on the WIN7 computers for many years. I did this after > upgrading/installing each Windows 10 workstation during 2019 Q4 and 2020 Q1, but apparently > that didn't work. > > For the Windows 10 workstations I create the "Time Source" group policy per the instructions in > https://wiki.samba.org/index.php/Time_Synchronisation. That didn't help either. > > Is it possible that the version of Samba I am using (Version 4.8.2) is too old for Windows 10? > I could upgrade to 4.13.2, but that is in the "experimental" release of Slackware and may or > may not install properly.I do not think 4.8.2 is too old for time sync to work with win 10. However 4.8.2 is EOL as far as samba is concerned. A couple of weeks ago I was still running 4.8.x on 2 different Ad domains and time sync was working fine on all of the clients, including the win 10. I would suggest you have a look at https://wiki.samba.org/index.php/Time_Synchronisation In particular make sure the symlink points to the correct place. After we upgraded the DC's to 4.12.x the symlinks got b0rked and that killed time sync for us. Fixing the symlinks and restarting chronyd and samba fixed the problem. FWIW, there is no extra configuration required on windows domain members assuming that the DC's are configured correctly. Just use w32tm /query /source to make sure the clients are using one of the DC's to sync from. If they are not then there is a problem with the DC configuration. Regards, -- Tom me at tdiehl.org
On Wed, 18 Nov 2020 08:41:03 -0500 me at tdiehl.org wrote:> > On Wed, 18 Nov 2020, Mark Foley via samba wrote: > > > After our office upgraded to Windows 10, time sync stopped working with the Windows > > workstations. This used to work fine with Windows 7 and still works with linux domain members > > (although that's not surprising). > > > > The Windows 10 workstations ended up operating off the CMOS clock. We didn't notice this for a long > > time since the CMOS clock drift is slow, but after several months users started noticing up to > > +/-6 minutes difference between their computers and the *real* time. > > > > Going to 'Date & Time settings > Sync Now' always gives "Time synchronization failed". > > > > For Windows 7 workstations, several years ago, I followed the advice in > > https://www.meinbergglobal.com/english/info/ntp-w32time.htm which was to do the following on > > the Windows 7 workstations: > > > > > > w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL > > w32tm /config /update > > > > Check the configuration: > > > > w32tm /query /source > > > > This worked and time was in-sync on the WIN7 computers for many years. I did this after > > upgrading/installing each Windows 10 workstation during 2019 Q4 and 2020 Q1, but apparently > > that didn't work. > > > > For the Windows 10 workstations I create the "Time Source" group policy per the instructions in > > https://wiki.samba.org/index.php/Time_Synchronisation. That didn't help either. > > > > Is it possible that the version of Samba I am using (Version 4.8.2) is too old for Windows 10? > > I could upgrade to 4.13.2, but that is in the "experimental" release of Slackware and may or > > may not install properly. > > I do not think 4.8.2 is too old for time sync to work with win 10. However > 4.8.2 is EOL as far as samba is concerned. > > A couple of weeks ago I was still running 4.8.x on 2 different Ad domains > and time sync was working fine on all of the clients, including the win 10. > > I would suggest you have a look at https://wiki.samba.org/index.php/Time_Synchronisation > In particular make sure the symlink points to the correct place. > > After we upgraded the DC's to 4.12.x the symlinks got b0rked and that killed time sync > for us. Fixing the symlinks and restarting chronyd and samba fixed the problem. > > FWIW, there is no extra configuration required on windows domain members assuming > that the DC's are configured correctly. Just use w32tm /query /source to make sure > the clients are using one of the DC's to sync from. If they are not then there is > a problem with the DC configuration. > > Regards, > > -- > Tom me at tdiehl.org >Tom - thanks for your reply. Question: on your Windows 10 workstation when you go to the Date & Time setting, what does it show for Time Server? After doing the steps described below on two of the WIN10 worstations, one shows "Time Server: unspecified" and the other shows "Local CMOS Clock". Can you click on "Sync Now" and have it work? I continue to get "Time synchronization failed". I've put these questions up-front so they don't get buried below. Your post was useful (though things still don't appear to be competely working). I'm using ntpd, not chrony. Rechecking the https://wiki.samba.org/index.php/Time_Synchronisation link I noted that it said, "Requirements: ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support (--enable-ntp-signd)". I didn't know if my version of ntpd was compile with --enable-ntp-signd. While trying to figure that out I came across the potentially very useful webpage https://blog.svedr.in/posts/configuring-ntpd-for-a-samba-4-domain. It gave the following instruction to see where Samba wants to put the ntp_signd socket: # netstat -xpln | grep signd unix 2 [ ACC ] STREAM LISTENING 2071520535 19381/samba /var/lib/samba/ntp_signd/socket This location is different from what the Samba wiki specified (/usr/local/samba/var/lib/ntp_signd), so I changed my ntp.conf to be the one found by netstat. That blog also advised adding "noquery" to the restrict config: restrict default kod limited nomodify notrap nopeer noquery mssntp His example had two lines with -4 and -6 after the "restrict" directive, respectively. I hope my not using those isn't a problem. Finally, the blog advised adding "listen": listen on 192.168.0.2 This is the IP of the server running ntpd. Not sure why that would be needed, never was in the past, hope it doesn't hurt. I restarted ntpd and, according to the blog, checked syslog to confirm signd: Nov 19 01:40:33 mail ntpd[10076]: mssntp restrict bit ignored, this ntpd was configured without --enable-ntp-signd. So, there's my first problem! My ntpd is not compiled with --enable-ntp-signd. So, I downloaded ntpd 4.2.8p15 (same version as I already have) from ntp.org and built it. Turns out that --enable-ntp-signd is not a default for that either, so I re-config'd: ../configure --enable-ntp-signd When I restarted and checked the syslog I now have: Nov 19 01:50:14 mail ntpd[17169]: MS-SNTP signd operations currently block ntpd degrading service to all clients. which is what the blogs says should be there. However, as stated at top, the Windows 10 workstations are still not syncing. On 3 of the workstations I had manually set the time server to an external time server: w32tm /config /manualpeerlist:0.us.pool.ntp.org /syncfromflags:manual /reliable:YES /update and on several others I manually set the time server to the Samba AD server, per my O.P.: w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL Prior to fixing ntpd with signd the workstations set to the external server were syncing since the "Last successful time synchronization" kept updating. The ones set to the local Samba server were months out of date. In order to try and undo my manual settings, I did the following on both external time-sync and local Samba time-sync workstations: net stop w32time w32tm /unregister w32tm /register net start w32time and rebooted. That didn't help. Still not getting time to sync with Samba, and: w32tm /query /source still shows "Local CMOS Clock". My current ntp.conf is below. If you or anyone has any idea as to what could still be wrong, I'd greatly appreciate the help. This problem has been ongoing for several months. Below is my current ntp.conf: ---------------------------- logfile /var/log/ntpd.log # note, this file is empty!? server 0.pool.ntp.org iburst prefer server 1.pool.ntp.org iburst server 127.127.1.0 # local clock fudge 127.127.1.0 stratum 10 driftfile /etc/ntp/drift ntpsigndsocket /var/lib/samba/ntp_signd/socket listen on 192.168.0.2 restrict default kod limited nomodify notrap nopeer noquery mssntp restrict 127.0.0.1 restrict ::1 restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery
From: Mark Foley via samba <samba at lists.samba.org> To: "samba at lists.samba.org" <samba at lists.samba.org> Subject: Re: [Samba] Time sync not working with Windows 10 Date: Thu, 19 Nov 2020 22:13:40 +0000> > On Wed, 18 Nov 2020 08:41:03 -0500 me at tdiehl.org wrote: > > > > On Wed, 18 Nov 2020, Mark Foley via samba wrote: > > > > > After our office upgraded to Windows 10, time sync stopped working with the Windows > > > workstations. This used to work fine with Windows 7 and still works with linux domain members > > > (although that's not surprising). > > > > > > The Windows 10 workstations ended up operating off the CMOS clock. We didn't notice this for a long > > > time since the CMOS clock drift is slow, but after several months users started noticing up to > > > +/-6 minutes difference between their computers and the *real* time. > > > > > > Going to 'Date & Time settings > Sync Now' always gives "Time synchronization failed". > > > > > > For Windows 7 workstations, several years ago, I followed the advice in > > > https://www.meinbergglobal.com/english/info/ntp-w32time.htm which was to do the following on > > > the Windows 7 workstations: > > > > > > > > > w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL > > > w32tm /config /update > > > > > > Check the configuration: > > > > > > w32tm /query /source > > > > > > This worked and time was in-sync on the WIN7 computers for many years. I did this after > > > upgrading/installing each Windows 10 workstation during 2019 Q4 and 2020 Q1, but apparently > > > that didn't work. > > > > > > For the Windows 10 workstations I create the "Time Source" group policy per the instructions in > > > https://wiki.samba.org/index.php/Time_Synchronisation. That didn't help either. > > > > > > Is it possible that the version of Samba I am using (Version 4.8.2) is too old for Windows 10? > > > I could upgrade to 4.13.2, but that is in the "experimental" release of Slackware and may or > > > may not install properly. > > > > I do not think 4.8.2 is too old for time sync to work with win 10. However > > 4.8.2 is EOL as far as samba is concerned. > > > > A couple of weeks ago I was still running 4.8.x on 2 different Ad domains > > and time sync was working fine on all of the clients, including the win 10. > > > > I would suggest you have a look at https://wiki.samba.org/index.php/Time_Synchronisation > > In particular make sure the symlink points to the correct place. > > > > After we upgraded the DC's to 4.12.x the symlinks got b0rked and that killed time sync > > for us. Fixing the symlinks and restarting chronyd and samba fixed the problem. > > > > FWIW, there is no extra configuration required on windows domain members assuming > > that the DC's are configured correctly. Just use w32tm /query /source to make sure > > the clients are using one of the DC's to sync from. If they are not then there is > > a problem with the DC configuration. > > > > Regards, > > > > -- > > Tom me at tdiehl.org > > > > Tom - thanks for your reply. Question: on your Windows 10 workstation when you go to the Date > & Time setting, what does it show for Time Server? After doing the steps described below on two > of the WIN10 worstations, one shows "Time Server: unspecified" and the other shows "Local CMOS > Clock". > > Can you click on "Sync Now" and have it work? I continue to get "Time synchronization failed". > > I've put these questions up-front so they don't get buried below. > > Your post was useful (though things still don't appear to be competely working). I'm using > ntpd, not chrony. Rechecking the > https://wiki.samba.org/index.php/Time_Synchronisation link I noted that it said, "Requirements: > ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support > (--enable-ntp-signd)". I didn't know if my version of ntpd was compile with --enable-ntp-signd. > > While trying to figure that out I came across the potentially very useful webpage > https://blog.svedr.in/posts/configuring-ntpd-for-a-samba-4-domain. It gave the following > instruction to see where Samba wants to put the ntp_signd socket: > > # netstat -xpln | grep signd > unix 2 [ ACC ] STREAM LISTENING 2071520535 19381/samba /var/lib/samba/ntp_signd/socket > > This location is different from what the Samba wiki specified (/usr/local/samba/var/lib/ntp_signd), > so I changed my ntp.conf to be the one found by netstat. > > That blog also advised adding "noquery" to the restrict config: > > restrict default kod limited nomodify notrap nopeer noquery mssntp > > His example had two lines with -4 and -6 after the "restrict" directive, respectively. I hope > my not using those isn't a problem. > > Finally, the blog advised adding "listen": > > listen on 192.168.0.2 > > This is the IP of the server running ntpd. Not sure why that would be needed, never was in the > past, hope it doesn't hurt. > > I restarted ntpd and, according to the blog, checked syslog to confirm signd: > > Nov 19 01:40:33 mail ntpd[10076]: mssntp restrict bit ignored, this ntpd was configured without --enable-ntp-signd. > > So, there's my first problem! My ntpd is not compiled with --enable-ntp-signd. So, I downloaded > ntpd 4.2.8p15 (same version as I already have) from ntp.org and built it. Turns out that > --enable-ntp-signd is not a default for that either, so I re-config'd: > > ../configure --enable-ntp-signd > > When I restarted and checked the syslog I now have: > > Nov 19 01:50:14 mail ntpd[17169]: MS-SNTP signd operations currently block ntpd degrading service to all clients. > > which is what the blogs says should be there. > > However, as stated at top, the Windows 10 workstations are still not syncing. On 3 of the > workstations I had manually set the time server to an external time server: > > w32tm /config /manualpeerlist:0.us.pool.ntp.org /syncfromflags:manual /reliable:YES /update > > and on several others I manually set the time server to the Samba AD server, per my O.P.: > > w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL > > Prior to fixing ntpd with signd the workstations set to the external server were syncing since > the "Last successful time synchronization" kept updating. The ones set to the local Samba > server were months out of date. > > In order to try and undo my manual settings, I did the following on both external time-sync and > local Samba time-sync workstations: > > net stop w32time > w32tm /unregister > w32tm /register > net start w32time > > and rebooted. That didn't help. Still not getting time to sync with Samba, and: > > w32tm /query /source > > still shows "Local CMOS Clock". > > My current ntp.conf is below. If you or anyone has any idea as to what could still be wrong, > I'd greatly appreciate the help. This problem has been ongoing for several months. > > Below is my current ntp.conf: > ---------------------------- > logfile /var/log/ntpd.log # note, this file is empty!? > > server 0.pool.ntp.org iburst prefer > server 1.pool.ntp.org iburst > server 127.127.1.0 # local clock > fudge 127.127.1.0 stratum 10 > > driftfile /etc/ntp/drift > ntpsigndsocket /var/lib/samba/ntp_signd/socket > > listen on 192.168.0.2 > > restrict default kod limited nomodify notrap nopeer noquery mssntp > > restrict 127.0.0.1 > restrict ::1 > > restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery > restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery >SOLVED! The last problem was with my ntpsigndsocket setting. Based on the netstat command (described above) I changed ntp.conf to: ntpsigndsocket /var/lib/samba/ntp_signd/socket The problem here is that "socket" from the netstat command is the actual socket. my setting caused a sub-directory "socket" to be created. The solution was to change the setting to: ntpsigndsocket /var/lib/samba/ntp_signd then stop ntp and samba and 'rm -r /var/lib/samba/ntp_signd' so Samba could create the ntp_signd directory itself. All that remained was to undo the various experimental settings I had done on the Windows 10 workstations. As admin on WIN10: net stop w32time w32tm /unregister w32tm /register net start w32time On most workstations the net stop and net start failed and I had to reboot the workstations. Of course, the Windows Group Policy had to be set according to the Samba wiki, but that had already been done weeks ago. Whew! This has been a months long struggle! --Mark
On 22/11/2020 02:04, Mark Foley via samba wrote:> From: Mark Foley via samba <samba at lists.samba.org> > To: "samba at lists.samba.org" <samba at lists.samba.org> > Subject: Re: [Samba] Time sync not working with Windows 10 > Date: Thu, 19 Nov 2020 22:13:40 +0000 > >> On Wed, 18 Nov 2020 08:41:03 -0500 me at tdiehl.org wrote: >>> On Wed, 18 Nov 2020, Mark Foley via samba wrote: >>> >>>> After our office upgraded to Windows 10, time sync stopped working with the Windows >>>> workstations. This used to work fine with Windows 7 and still works with linux domain members >>>> (although that's not surprising). >>>> >>>> The Windows 10 workstations ended up operating off the CMOS clock. We didn't notice this for a long >>>> time since the CMOS clock drift is slow, but after several months users started noticing up to >>>> +/-6 minutes difference between their computers and the *real* time. >>>> >>>> Going to 'Date & Time settings > Sync Now' always gives "Time synchronization failed". >>>> >>>> For Windows 7 workstations, several years ago, I followed the advice in >>>> https://www.meinbergglobal.com/english/info/ntp-w32time.htm which was to do the following on >>>> the Windows 7 workstations: >>>> >>>> >>>> w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL >>>> w32tm /config /update >>>> >>>> Check the configuration: >>>> >>>> w32tm /query /source >>>> >>>> This worked and time was in-sync on the WIN7 computers for many years. I did this after >>>> upgrading/installing each Windows 10 workstation during 2019 Q4 and 2020 Q1, but apparently >>>> that didn't work. >>>> >>>> For the Windows 10 workstations I create the "Time Source" group policy per the instructions in >>>> https://wiki.samba.org/index.php/Time_Synchronisation. That didn't help either. >>>> >>>> Is it possible that the version of Samba I am using (Version 4.8.2) is too old for Windows 10? >>>> I could upgrade to 4.13.2, but that is in the "experimental" release of Slackware and may or >>>> may not install properly. >>> I do not think 4.8.2 is too old for time sync to work with win 10. However >>> 4.8.2 is EOL as far as samba is concerned. >>> >>> A couple of weeks ago I was still running 4.8.x on 2 different Ad domains >>> and time sync was working fine on all of the clients, including the win 10. >>> >>> I would suggest you have a look at https://wiki.samba.org/index.php/Time_Synchronisation >>> In particular make sure the symlink points to the correct place. >>> >>> After we upgraded the DC's to 4.12.x the symlinks got b0rked and that killed time sync >>> for us. Fixing the symlinks and restarting chronyd and samba fixed the problem. >>> >>> FWIW, there is no extra configuration required on windows domain members assuming >>> that the DC's are configured correctly. Just use w32tm /query /source to make sure >>> the clients are using one of the DC's to sync from. If they are not then there is >>> a problem with the DC configuration. >>> >>> Regards, >>> >>> -- >>> Tom me at tdiehl.org >>> >> Tom - thanks for your reply. Question: on your Windows 10 workstation when you go to the Date >> & Time setting, what does it show for Time Server? After doing the steps described below on two >> of the WIN10 worstations, one shows "Time Server: unspecified" and the other shows "Local CMOS >> Clock". >> >> Can you click on "Sync Now" and have it work? I continue to get "Time synchronization failed". >> >> I've put these questions up-front so they don't get buried below. >> >> Your post was useful (though things still don't appear to be competely working). I'm using >> ntpd, not chrony. Rechecking the >> https://wiki.samba.org/index.php/Time_Synchronisation link I noted that it said, "Requirements: >> ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support >> (--enable-ntp-signd)". I didn't know if my version of ntpd was compile with --enable-ntp-signd. >> >> While trying to figure that out I came across the potentially very useful webpage >> https://blog.svedr.in/posts/configuring-ntpd-for-a-samba-4-domain. It gave the following >> instruction to see where Samba wants to put the ntp_signd socket: >> >> # netstat -xpln | grep signd >> unix 2 [ ACC ] STREAM LISTENING 2071520535 19381/samba /var/lib/samba/ntp_signd/socket >> >> This location is different from what the Samba wiki specified (/usr/local/samba/var/lib/ntp_signd), >> so I changed my ntp.conf to be the one found by netstat. >> >> That blog also advised adding "noquery" to the restrict config: >> >> restrict default kod limited nomodify notrap nopeer noquery mssntp >> >> His example had two lines with -4 and -6 after the "restrict" directive, respectively. I hope >> my not using those isn't a problem. >> >> Finally, the blog advised adding "listen": >> >> listen on 192.168.0.2 >> >> This is the IP of the server running ntpd. Not sure why that would be needed, never was in the >> past, hope it doesn't hurt. >> >> I restarted ntpd and, according to the blog, checked syslog to confirm signd: >> >> Nov 19 01:40:33 mail ntpd[10076]: mssntp restrict bit ignored, this ntpd was configured without --enable-ntp-signd. >> >> So, there's my first problem! My ntpd is not compiled with --enable-ntp-signd. So, I downloaded >> ntpd 4.2.8p15 (same version as I already have) from ntp.org and built it. Turns out that >> --enable-ntp-signd is not a default for that either, so I re-config'd: >> >> ../configure --enable-ntp-signd >> >> When I restarted and checked the syslog I now have: >> >> Nov 19 01:50:14 mail ntpd[17169]: MS-SNTP signd operations currently block ntpd degrading service to all clients. >> >> which is what the blogs says should be there. >> >> However, as stated at top, the Windows 10 workstations are still not syncing. On 3 of the >> workstations I had manually set the time server to an external time server: >> >> w32tm /config /manualpeerlist:0.us.pool.ntp.org /syncfromflags:manual /reliable:YES /update >> >> and on several others I manually set the time server to the Samba AD server, per my O.P.: >> >> w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL >> >> Prior to fixing ntpd with signd the workstations set to the external server were syncing since >> the "Last successful time synchronization" kept updating. The ones set to the local Samba >> server were months out of date. >> >> In order to try and undo my manual settings, I did the following on both external time-sync and >> local Samba time-sync workstations: >> >> net stop w32time >> w32tm /unregister >> w32tm /register >> net start w32time >> >> and rebooted. That didn't help. Still not getting time to sync with Samba, and: >> >> w32tm /query /source >> >> still shows "Local CMOS Clock". >> >> My current ntp.conf is below. If you or anyone has any idea as to what could still be wrong, >> I'd greatly appreciate the help. This problem has been ongoing for several months. >> >> Below is my current ntp.conf: >> ---------------------------- >> logfile /var/log/ntpd.log # note, this file is empty!? >> >> server 0.pool.ntp.org iburst prefer >> server 1.pool.ntp.org iburst >> server 127.127.1.0 # local clock >> fudge 127.127.1.0 stratum 10 >> >> driftfile /etc/ntp/drift >> ntpsigndsocket /var/lib/samba/ntp_signd/socket >> >> listen on 192.168.0.2 >> >> restrict default kod limited nomodify notrap nopeer noquery mssntp >> >> restrict 127.0.0.1 >> restrict ::1 >> >> restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery >> restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery >> > SOLVED! > > The last problem was with my ntpsigndsocket setting. Based on the netstat command (described > above) I changed ntp.conf to: > > ntpsigndsocket /var/lib/samba/ntp_signd/socket > > The problem here is that "socket" from the netstat command is the actual socket. my setting > caused a sub-directory "socket" to be created. The solution was to change the setting to: > > ntpsigndsocket /var/lib/samba/ntp_signd > > > Whew! This has been a months long struggle!So, you didn't read this wiki page: https://wiki.samba.org/index.php/Time_Synchronisation ? Rowland
On Sun, 22 Nov 2020 09:56:07 Rowland penny <rpenny at samba.org> wrote:> > On 22/11/2020 02:04, Mark Foley via samba wrote: > > From: Mark Foley via samba <samba at lists.samba.org> > > To: "samba at lists.samba.org" <samba at lists.samba.org> > > Subject: Re: [Samba] Time sync not working with Windows 10 > > Date: Thu, 19 Nov 2020 22:13:40 +0000 > > > >> On Wed, 18 Nov 2020 08:41:03 -0500 me at tdiehl.org wrote: > >>> On Wed, 18 Nov 2020, Mark Foley via samba wrote: > >>> > >>>> After our office upgraded to Windows 10, time sync stopped working with the Windows > >>>> workstations. This used to work fine with Windows 7 and still works with linux domain members > >>>> (although that's not surprising). > >>>> > >>>> The Windows 10 workstations ended up operating off the CMOS clock. We didn't notice this for a long > >>>> time since the CMOS clock drift is slow, but after several months users started noticing up to > >>>> +/-6 minutes difference between their computers and the *real* time. > >>>> > >>>> Going to 'Date & Time settings > Sync Now' always gives "Time synchronization failed". > >>>> > >>>> For Windows 7 workstations, several years ago, I followed the advice in > >>>> https://www.meinbergglobal.com/english/info/ntp-w32time.htm which was to do the following on > >>>> the Windows 7 workstations: > >>>> > >>>> > >>>> w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL > >>>> w32tm /config /update > >>>> > >>>> Check the configuration: > >>>> > >>>> w32tm /query /source > >>>> > >>>> This worked and time was in-sync on the WIN7 computers for many years. I did this after > >>>> upgrading/installing each Windows 10 workstation during 2019 Q4 and 2020 Q1, but apparently > >>>> that didn't work. > >>>> > >>>> For the Windows 10 workstations I create the "Time Source" group policy per the instructions in > >>>> https://wiki.samba.org/index.php/Time_Synchronisation. That didn't help either. > >>>> > >>>> Is it possible that the version of Samba I am using (Version 4.8.2) is too old for Windows 10? > >>>> I could upgrade to 4.13.2, but that is in the "experimental" release of Slackware and may or > >>>> may not install properly. > >>> I do not think 4.8.2 is too old for time sync to work with win 10. However > >>> 4.8.2 is EOL as far as samba is concerned. > >>> > >>> A couple of weeks ago I was still running 4.8.x on 2 different Ad domains > >>> and time sync was working fine on all of the clients, including the win 10. > >>> > >>> I would suggest you have a look at https://wiki.samba.org/index.php/Time_Synchronisation > >>> In particular make sure the symlink points to the correct place. > >>> > >>> After we upgraded the DC's to 4.12.x the symlinks got b0rked and that killed time sync > >>> for us. Fixing the symlinks and restarting chronyd and samba fixed the problem. > >>> > >>> FWIW, there is no extra configuration required on windows domain members assuming > >>> that the DC's are configured correctly. Just use w32tm /query /source to make sure > >>> the clients are using one of the DC's to sync from. If they are not then there is > >>> a problem with the DC configuration. > >>> > >>> Regards, > >>> > >>> -- > >>> Tom me at tdiehl.org > >>> > >> Tom - thanks for your reply. Question: on your Windows 10 workstation when you go to the Date > >> & Time setting, what does it show for Time Server? After doing the steps described below on two > >> of the WIN10 worstations, one shows "Time Server: unspecified" and the other shows "Local CMOS > >> Clock". > >> > >> Can you click on "Sync Now" and have it work? I continue to get "Time synchronization failed". > >> > >> I've put these questions up-front so they don't get buried below. > >> > >> Your post was useful (though things still don't appear to be competely working). I'm using > >> ntpd, not chrony. Rechecking the > >> https://wiki.samba.org/index.php/Time_Synchronisation link I noted that it said, "Requirements: > >> ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support > >> (--enable-ntp-signd)". I didn't know if my version of ntpd was compile with --enable-ntp-signd. > >> > >> While trying to figure that out I came across the potentially very useful webpage > >> https://blog.svedr.in/posts/configuring-ntpd-for-a-samba-4-domain. It gave the following > >> instruction to see where Samba wants to put the ntp_signd socket: > >> > >> # netstat -xpln | grep signd > >> unix 2 [ ACC ] STREAM LISTENING 2071520535 19381/samba /var/lib/samba/ntp_signd/socket > >> > >> This location is different from what the Samba wiki specified (/usr/local/samba/var/lib/ntp_signd), > >> so I changed my ntp.conf to be the one found by netstat. > >> > >> That blog also advised adding "noquery" to the restrict config: > >> > >> restrict default kod limited nomodify notrap nopeer noquery mssntp > >> > >> His example had two lines with -4 and -6 after the "restrict" directive, respectively. I hope > >> my not using those isn't a problem. > >> > >> Finally, the blog advised adding "listen": > >> > >> listen on 192.168.0.2 > >> > >> This is the IP of the server running ntpd. Not sure why that would be needed, never was in the > >> past, hope it doesn't hurt. > >> > >> I restarted ntpd and, according to the blog, checked syslog to confirm signd: > >> > >> Nov 19 01:40:33 mail ntpd[10076]: mssntp restrict bit ignored, this ntpd was configured without --enable-ntp-signd. > >> > >> So, there's my first problem! My ntpd is not compiled with --enable-ntp-signd. So, I downloaded > >> ntpd 4.2.8p15 (same version as I already have) from ntp.org and built it. Turns out that > >> --enable-ntp-signd is not a default for that either, so I re-config'd: > >> > >> ../configure --enable-ntp-signd > >> > >> When I restarted and checked the syslog I now have: > >> > >> Nov 19 01:50:14 mail ntpd[17169]: MS-SNTP signd operations currently block ntpd degrading service to all clients. > >> > >> which is what the blogs says should be there. > >> > >> However, as stated at top, the Windows 10 workstations are still not syncing. On 3 of the > >> workstations I had manually set the time server to an external time server: > >> > >> w32tm /config /manualpeerlist:0.us.pool.ntp.org /syncfromflags:manual /reliable:YES /update > >> > >> and on several others I manually set the time server to the Samba AD server, per my O.P.: > >> > >> w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL > >> > >> Prior to fixing ntpd with signd the workstations set to the external server were syncing since > >> the "Last successful time synchronization" kept updating. The ones set to the local Samba > >> server were months out of date. > >> > >> In order to try and undo my manual settings, I did the following on both external time-sync and > >> local Samba time-sync workstations: > >> > >> net stop w32time > >> w32tm /unregister > >> w32tm /register > >> net start w32time > >> > >> and rebooted. That didn't help. Still not getting time to sync with Samba, and: > >> > >> w32tm /query /source > >> > >> still shows "Local CMOS Clock". > >> > >> My current ntp.conf is below. If you or anyone has any idea as to what could still be wrong, > >> I'd greatly appreciate the help. This problem has been ongoing for several months. > >> > >> Below is my current ntp.conf: > >> ---------------------------- > >> logfile /var/log/ntpd.log # note, this file is empty!? > >> > >> server 0.pool.ntp.org iburst prefer > >> server 1.pool.ntp.org iburst > >> server 127.127.1.0 # local clock > >> fudge 127.127.1.0 stratum 10 > >> > >> driftfile /etc/ntp/drift > >> ntpsigndsocket /var/lib/samba/ntp_signd/socket > >> > >> listen on 192.168.0.2 > >> > >> restrict default kod limited nomodify notrap nopeer noquery mssntp > >> > >> restrict 127.0.0.1 > >> restrict ::1 > >> > >> restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery > >> restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery > >> > > SOLVED! > > > > The last problem was with my ntpsigndsocket setting. Based on the netstat command (described > > above) I changed ntp.conf to: > > > > ntpsigndsocket /var/lib/samba/ntp_signd/socket > > > > The problem here is that "socket" from the netstat command is the actual socket. my setting > > caused a sub-directory "socket" to be created. The solution was to change the setting to: > > > > ntpsigndsocket /var/lib/samba/ntp_signd > > > > > > Whew! This has been a months long struggle! > So, you didn't read this wiki page: > https://wiki.samba.org/index.php/Time_Synchronisation ? > > RowlandYes, I did, as mentioned in my O.P. But there were some details the wiki didn't address in my case. First, the path stated in the wiki for the ntpsigndsocket was incorrect for my system. I don't know why. Perhaps my distro put it somewhere else. A very useful blog: https://blog.svedr.in/posts/configuring-ntpd-for-a-samba-4-domain, gave me instructions to determine where Samba creates the ntp_signd socket: netstat -xpln | grep signd Which on my system gave: /var/lib/samba/ntp_signd/socket versus the wiki: /usr/local/samba/var/lib/ntp_signd/ So, I had to change the ntpsigndsocket setting in ntp.conf or nothing was going to work. Perhaps this tip should be included in the wiki doc. Second, I didn't realize that the netstat command gave me the full path, including the socket itself. So my correct ntpsigndsocket setting is: ntpsigndsocket /var/lib/samba/ntp_signd As part of this point, I didn't know Samba had to be allowed to create the ntp_signd directory. So I had to stop Samba and ntpd and do: rm -r /var/lib/samba/ntp_signd Even though I had the correct path, timesync still would not work until I removed this directory. I found this tip in another post whose URL I don't recall. Again, perhaps this should be part of the aforementioned wiki tip. Finally, I had no way of knowing for sure that my ntpd was built with --enable-ntp-signd or not. ntpd does not have equivalent of samba's -b option to show how it was built. Again, the blog mentioned above gave the tip to look in syslog which should show: Apr 9 20:15:24 dc ntpd[30129]: MS-SNTP signd operations currently block ntpd degrading service to all clients. to confirm SIGND was working. Instead, I got: Nov 19 01:40:33 mail ntpd[10076]: mssntp restrict bit ignored, this ntpd was configured without --enable-ntp-signd. confirming that my ntpd was not built with --enable-ntp-signd. By default, the build of sources from ntp.org also does not build with --enable-ntp-signd by default. To do so, one must run: .configure --enable-ntp-signd This tip on determining whether or not ntpd was built with --enable-ntp-signd would also be useful in the wiki. Perhaps I'm the only one who has run into this issue, but if these two tips (netstat to deteremine the socket path and syslog to determine SIGND enabled) had been included in the wiki it would have saved me hours of searching through the web for numerous useful links. --Mark
On 23/11/2020 19:40, Mark Foley via samba wrote:> On Sun, 22 Nov 2020 09:56:07 Rowland penny <rpenny at samba.org> wrote: >> On 22/11/2020 02:04, Mark Foley via samba wrote: >>> From: Mark Foley via samba <samba at lists.samba.org> >>> To: "samba at lists.samba.org" <samba at lists.samba.org> >>> Subject: Re: [Samba] Time sync not working with Windows 10 >>> Date: Thu, 19 Nov 2020 22:13:40 +0000 >>> >>>> On Wed, 18 Nov 2020 08:41:03 -0500 me at tdiehl.org wrote: >>>>> On Wed, 18 Nov 2020, Mark Foley via samba wrote: >>>>> >>>>>> After our office upgraded to Windows 10, time sync stopped working with the Windows >>>>>> workstations. This used to work fine with Windows 7 and still works with linux domain members >>>>>> (although that's not surprising). >>>>>> >>>>>> The Windows 10 workstations ended up operating off the CMOS clock. We didn't notice this for a long >>>>>> time since the CMOS clock drift is slow, but after several months users started noticing up to >>>>>> +/-6 minutes difference between their computers and the *real* time. >>>>>> >>>>>> Going to 'Date & Time settings > Sync Now' always gives "Time synchronization failed". >>>>>> >>>>>> For Windows 7 workstations, several years ago, I followed the advice in >>>>>> https://www.meinbergglobal.com/english/info/ntp-w32time.htm which was to do the following on >>>>>> the Windows 7 workstations: >>>>>> >>>>>> >>>>>> w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL >>>>>> w32tm /config /update >>>>>> >>>>>> Check the configuration: >>>>>> >>>>>> w32tm /query /source >>>>>> >>>>>> This worked and time was in-sync on the WIN7 computers for many years. I did this after >>>>>> upgrading/installing each Windows 10 workstation during 2019 Q4 and 2020 Q1, but apparently >>>>>> that didn't work. >>>>>> >>>>>> For the Windows 10 workstations I create the "Time Source" group policy per the instructions in >>>>>> https://wiki.samba.org/index.php/Time_Synchronisation. That didn't help either. >>>>>> >>>>>> Is it possible that the version of Samba I am using (Version 4.8.2) is too old for Windows 10? >>>>>> I could upgrade to 4.13.2, but that is in the "experimental" release of Slackware and may or >>>>>> may not install properly. >>>>> I do not think 4.8.2 is too old for time sync to work with win 10. However >>>>> 4.8.2 is EOL as far as samba is concerned. >>>>> >>>>> A couple of weeks ago I was still running 4.8.x on 2 different Ad domains >>>>> and time sync was working fine on all of the clients, including the win 10. >>>>> >>>>> I would suggest you have a look at https://wiki.samba.org/index.php/Time_Synchronisation >>>>> In particular make sure the symlink points to the correct place. >>>>> >>>>> After we upgraded the DC's to 4.12.x the symlinks got b0rked and that killed time sync >>>>> for us. Fixing the symlinks and restarting chronyd and samba fixed the problem. >>>>> >>>>> FWIW, there is no extra configuration required on windows domain members assuming >>>>> that the DC's are configured correctly. Just use w32tm /query /source to make sure >>>>> the clients are using one of the DC's to sync from. If they are not then there is >>>>> a problem with the DC configuration. >>>>> >>>>> Regards, >>>>> >>>>> -- >>>>> Tom me at tdiehl.org >>>>> >>>> Tom - thanks for your reply. Question: on your Windows 10 workstation when you go to the Date >>>> & Time setting, what does it show for Time Server? After doing the steps described below on two >>>> of the WIN10 worstations, one shows "Time Server: unspecified" and the other shows "Local CMOS >>>> Clock". >>>> >>>> Can you click on "Sync Now" and have it work? I continue to get "Time synchronization failed". >>>> >>>> I've put these questions up-front so they don't get buried below. >>>> >>>> Your post was useful (though things still don't appear to be competely working). I'm using >>>> ntpd, not chrony. Rechecking the >>>> https://wiki.samba.org/index.php/Time_Synchronisation link I noted that it said, "Requirements: >>>> ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support >>>> (--enable-ntp-signd)". I didn't know if my version of ntpd was compile with --enable-ntp-signd. >>>> >>>> While trying to figure that out I came across the potentially very useful webpage >>>> https://blog.svedr.in/posts/configuring-ntpd-for-a-samba-4-domain. It gave the following >>>> instruction to see where Samba wants to put the ntp_signd socket: >>>> >>>> # netstat -xpln | grep signd >>>> unix 2 [ ACC ] STREAM LISTENING 2071520535 19381/samba /var/lib/samba/ntp_signd/socket >>>> >>>> This location is different from what the Samba wiki specified (/usr/local/samba/var/lib/ntp_signd), >>>> so I changed my ntp.conf to be the one found by netstat. >>>> >>>> That blog also advised adding "noquery" to the restrict config: >>>> >>>> restrict default kod limited nomodify notrap nopeer noquery mssntp >>>> >>>> His example had two lines with -4 and -6 after the "restrict" directive, respectively. I hope >>>> my not using those isn't a problem. >>>> >>>> Finally, the blog advised adding "listen": >>>> >>>> listen on 192.168.0.2 >>>> >>>> This is the IP of the server running ntpd. Not sure why that would be needed, never was in the >>>> past, hope it doesn't hurt. >>>> >>>> I restarted ntpd and, according to the blog, checked syslog to confirm signd: >>>> >>>> Nov 19 01:40:33 mail ntpd[10076]: mssntp restrict bit ignored, this ntpd was configured without --enable-ntp-signd. >>>> >>>> So, there's my first problem! My ntpd is not compiled with --enable-ntp-signd. So, I downloaded >>>> ntpd 4.2.8p15 (same version as I already have) from ntp.org and built it. Turns out that >>>> --enable-ntp-signd is not a default for that either, so I re-config'd: >>>> >>>> ../configure --enable-ntp-signd >>>> >>>> When I restarted and checked the syslog I now have: >>>> >>>> Nov 19 01:50:14 mail ntpd[17169]: MS-SNTP signd operations currently block ntpd degrading service to all clients. >>>> >>>> which is what the blogs says should be there. >>>> >>>> However, as stated at top, the Windows 10 workstations are still not syncing. On 3 of the >>>> workstations I had manually set the time server to an external time server: >>>> >>>> w32tm /config /manualpeerlist:0.us.pool.ntp.org /syncfromflags:manual /reliable:YES /update >>>> >>>> and on several others I manually set the time server to the Samba AD server, per my O.P.: >>>> >>>> w32tm /config /manualpeerlist:mail,0x8 /syncfromflags:MANUAL >>>> >>>> Prior to fixing ntpd with signd the workstations set to the external server were syncing since >>>> the "Last successful time synchronization" kept updating. The ones set to the local Samba >>>> server were months out of date. >>>> >>>> In order to try and undo my manual settings, I did the following on both external time-sync and >>>> local Samba time-sync workstations: >>>> >>>> net stop w32time >>>> w32tm /unregister >>>> w32tm /register >>>> net start w32time >>>> >>>> and rebooted. That didn't help. Still not getting time to sync with Samba, and: >>>> >>>> w32tm /query /source >>>> >>>> still shows "Local CMOS Clock". >>>> >>>> My current ntp.conf is below. If you or anyone has any idea as to what could still be wrong, >>>> I'd greatly appreciate the help. This problem has been ongoing for several months. >>>> >>>> Below is my current ntp.conf: >>>> ---------------------------- >>>> logfile /var/log/ntpd.log # note, this file is empty!? >>>> >>>> server 0.pool.ntp.org iburst prefer >>>> server 1.pool.ntp.org iburst >>>> server 127.127.1.0 # local clock >>>> fudge 127.127.1.0 stratum 10 >>>> >>>> driftfile /etc/ntp/drift >>>> ntpsigndsocket /var/lib/samba/ntp_signd/socket >>>> >>>> listen on 192.168.0.2 >>>> >>>> restrict default kod limited nomodify notrap nopeer noquery mssntp >>>> >>>> restrict 127.0.0.1 >>>> restrict ::1 >>>> >>>> restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery >>>> restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery >>>> >>> SOLVED! >>> >>> The last problem was with my ntpsigndsocket setting. Based on the netstat command (described >>> above) I changed ntp.conf to: >>> >>> ntpsigndsocket /var/lib/samba/ntp_signd/socket >>> >>> The problem here is that "socket" from the netstat command is the actual socket. my setting >>> caused a sub-directory "socket" to be created. The solution was to change the setting to: >>> >>> ntpsigndsocket /var/lib/samba/ntp_signd >>> >>> >>> Whew! This has been a months long struggle! >> So, you didn't read this wiki page: >> https://wiki.samba.org/index.php/Time_Synchronisation ? >> >> Rowland > Yes, I did, as mentioned in my O.P. But there were some details the wiki didn't address in my > case. > > First, the path stated in the wiki for the ntpsigndsocket was incorrect for my system.It probably would be in a different place if you use distro packages, the wiki is written from the point of view of using a self compiled Samba.> I don't > know why. Perhaps my distro put it somewhere else. A very useful blog: > https://blog.svedr.in/posts/configuring-ntpd-for-a-samba-4-domain, gave me instructions to > determine where Samba creates the ntp_signd socket:An even easier way to find out where your distro expects it is run this command: samba -b | grep 'NTP_SIGND_SOCKET_DIR' It even works before you provision and start the domain.> > netstat -xpln | grep signd > > Which on my system gave: > > /var/lib/samba/ntp_signd/socket > > versus the wiki: > > /usr/local/samba/var/lib/ntp_signd/Yes, but if you use the first path, it is still wrong.> > So, I had to change the ntpsigndsocket setting in ntp.conf or nothing was going to work. Perhaps > this tip should be included in the wiki doc.No, but perhaps we need to mention that all paths refer to a self compiled Samba unless otherwise mentioned.> > Second, I didn't realize that the netstat command gave me the full path, including the socket > itself. So my correct ntpsigndsocket setting is: > > ntpsigndsocket /var/lib/samba/ntp_signd > > As part of this point, I didn't know Samba had to be allowed to create the ntp_signd directory. > So I had to stop Samba and ntpd and do: > > rm -r /var/lib/samba/ntp_signd > > Even though I had the correct path, timesync still would not work until I removed this > directory. I found this tip in another post whose URL I don't recall. Again, perhaps this > should be part of the aforementioned wiki tip.Problem is, I don't create the directory and allow Samba to create it, but Louis creates it before he starts Samba and ntp, both methods seem to work, but seemingly not for yourself, perhaps the permissions were incorrect ?> > Finally, I had no way of knowing for sure that my ntpd was built with --enable-ntp-signd or > not. ntpd does not have equivalent of samba's -b option to show how it was built. Again, the > blog mentioned above gave the tip to look in syslog which should show: > > Apr 9 20:15:24 dc ntpd[30129]: MS-SNTP signd operations currently block ntpd degrading service to all clients. > > to confirm SIGND was working. Instead, I got: > > Nov 19 01:40:33 mail ntpd[10076]: mssntp restrict bit ignored, this ntpd was configured without --enable-ntp-signd. > > confirming that my ntpd was not built with --enable-ntp-signd. By default, the build of sources > from ntp.org also does not build with --enable-ntp-signd by default. To do so, one must run: > > .configure --enable-ntp-signd > > This tip on determining whether or not ntpd was built with --enable-ntp-signd would also be > useful in the wiki. > > Perhaps I'm the only one who has run into this issue, but if these two tips (netstat to > deteremine the socket path and syslog to determine SIGND enabled) had been included in the wiki > it would have saved me hours of searching through the web for numerous useful links.The part about checking if NTP was built to use ntp-signd should be in the wiki, so I will add it. You are not the first person to mention the wiki paths, but then again it doesn't come up that often, but it is often enough that we should document it somewhere, probably on the first page ??? Rowland