GPO´s won´t work when time sync service is disabled?

[Joerg Riether]

Hi NG,

I have a big problem here:

In our network (w2003 dc´s, 2000/xp clients) runs a very old DB-System named
Ingres.
This System covers the strange fact that the clients connected to it need
very special
time settings.

For this, it is necessary to turn off the time sync service.

We did this using GPO´s and it worked well. The time sync service na the
clients was
set to deactivated.

NOW: When we wanted to set back the GPO-time-sync-setting to automatic we
wondered
that the GPO didn´t work on the clients were the time sync service was
deactivated.

We were even more confused as we noticed, that NO GPO at all worked anymore
when the time sync service is deactivated.

When we manually on the client set the time sync service back to automatic,
GPO´s will
again work well.

Isn´t there any possibility to let the GPO´s work even if the time service
is
eactivated?

best regards
Jörg

 

[Derek Melber [MVP]]

My guess is the time synch service is not keeping the client and DCs within
5 minutes of one another, which will break GPOs. As long as the time is
within 5 minutes, GPOs should work.

 

[Joerg Riether]

Hi Derek,

thank you.
Is there a way to set this 5-minute-level up to let´s say 30 Minutes (w2003
domain native mode)?

best regards
Jörg

 

[serverguy]

Time synch is critical not only for GPO's but other domain acitivity
including authorization. I would seriously look at this from an application
standpoint and not "break" your domain by unsynching it.