Hi,

We have been having a troublesome issue w/o being able to solve it as of yet.

Symptoms:
Each day, at seemingly random, users connected to our domain are
disconnected and completely loose connection with the domain server. It
happends mor or less sometimes at 17:05-17:15 each day. It does not include
all users. But not all users are logged on until this time. Some days they
are not disconnected. There is no serverside service that I can think of that
would on purpose disconnect them and neither any specific software these
users have installed that might cause it (we run a very tight software
policy). Ive investigated this for quite some times and I am clueless.

Possible cause:
We have had alot of error reports generated by the w32tm service.

"Event Type: Error
Event Source: W32Time
Event Category: None
Event ID: 29
Date: 2007-03-29
Time: 09:13:15
User: N/A
Computer: MUPPET
Description:
The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 30 minutes. NtpClient has no
source of accurate time.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp."

The delay time for attempts to contact a source differ. At the begining of
each day its 15, at the end it can be 480 or even 960 minutes.

This leads me to believe we have an issue with the NTP time server.

W32tm register values:


"Value Name Value Type Value Data
--------------------------------------------------

Type REG_DWORD 32
Start REG_DWORD 2
ErrorControl REG_DWORD 1
ImagePath REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k
LocalS
ervice
DisplayName REG_SZ Windows Time
ObjectName REG_SZ NT AUTHORITY\LocalService
Description REG_SZ Maintains date and time synchronization
on
all clients and servers in the network. If this service is stopped, date and
tim
e synchronization will be unavailable. If this service is disabled, any
services
that explicitly depend on it will fail to start."

Subkey:Config
"Value Name Value Type Value Data
-----------------------------------------------------------

LastClockRate REG_DWORD 156250
MinClockRate REG_DWORD 155860
MaxClockRate REG_DWORD 156640
FrequencyCorrectRate REG_DWORD 4
PollAdjustFactor REG_DWORD 5
LargePhaseOffset REG_DWORD 1280000
SpikeWatchPeriod REG_DWORD 90
HoldPeriod REG_DWORD 5
LocalClockDispersion REG_DWORD 10
EventLogFlags REG_DWORD 2
PhaseCorrectRate REG_DWORD 7
MinPollInterval REG_DWORD 4
MaxPollInterval REG_DWORD 15
MaxNegPhaseCorrection REG_DWORD 54000
MaxPosPhaseCorrection REG_DWORD 3600
UpdateInterval REG_DWORD 100
AnnounceFlags REG_DWORD 6
MaxAllowedPhaseOffset REG_DWORD 300"

Subkey:Enum
"Value Name Value Type Value Data
--------------------------------------------------

0 REG_SZ Root\LEGACY_W32TIME\0000
Count REG_DWORD 1
NextInstance REG_DWORD 1"

Subkey:Parameters

"Value Name Value Type Value Data
--------------------------------------------------
ServiceMain REG_SZ SvchostEntry_W32Time
ServiceDll REG_EXPAND_SZ C:\WINDOWS\system32\w32time.dll
Type REG_SZ NTP
NtpServer REG_SZ time.umu.se"

Subkey:Timeproviders:NtpClient
"Value Name Value Type Value Data
----------------------------------------------------------------------

Enabled REG_DWORD 1
InputProvider REG_DWORD 1
AllowNonstandardModeCombinations REG_DWORD 1
CrossSiteSyncFlags REG_DWORD 2
ResolvePeerBackoffMinutes REG_DWORD 15
ResolvePeerBackoffMaxTimes REG_DWORD 7
CompatibilityFlags REG_DWORD -2147483648
EventLogFlags REG_DWORD 1
LargeSampleSkew REG_DWORD 3
DllName REG_SZ
C:\WINDOWS\system32\w32time.dll
SpecialPollTimeRemaining REG_MULTI_SZ
SpecialPollInterval REG_DWORD 3600"

SubKey:TimeProvider\NtpServer
"Value Name Value Type Value Data
----------------------------------------------------------------------

InputProvider REG_DWORD 0
AllowNonstandardModeCombinations REG_DWORD 1
DllName REG_SZ
C:\WINDOWS\system32\w32time.dll
Enabled REG_DWORD 1"

Other info:
UDP port 123 is open for our timeserver time.umu.se

Any ideas? We are desperate! Thanks!

Some additional information:

w32tm /monitor reports:
"H:\>w32tm /monitor
[(our DM server)] *** PDC *** [(local ip)]:
ICMP: 0ms delay.
NTP: +0.0000000s offset from [(DM server)]
RefID: 'LOCL' [(external ip)]"

(after w32time service have been stopped to avoid bug where tool and service
try to use port 123 simultaneously (documented by microsoft))
"H:\>w32tm /resync /rediscover
Sending resync command to local computer...
The following error occurred: The interface is unknown. (0x800706B5)"

What causes this?

"H:\>w32tm /stripchart /computer:it-support
Tracking it-support [192.168.193.29].
The current time is 2007-03-29 11:40:27 (local time).
11:40:27 error: 0x800705B4
11:40:30 error: 0x800705B4
11:40:33 error: 0x800705B4
11:40:36 error: 0x800705B4
11:40:39 error: 0x800705B4
11:40:42 error: 0x800705B4
11:40:45 error: 0x800705B4
11:40:48 error: 0x800705B4
11:40:51 error: 0x800705B4
11:40:54 error: 0x800705B4
11:40:57 error: 0x800705B4
11:41:00 error: 0x800705B4
11:41:03 error: 0x800705B4
11:41:06 error: 0x800705B4
11:41:09 error: 0x800705B4
11:41:12 error: 0x800705B4"

Also generates errors!

The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 14 minutes. NtpClient has no
source of accurate time.

Resolution: 1. Synchronize the computer with the DC.
2. You may want to setup NTP time. To setup the NTP time on the server, use
this command: Net Time /Setsntp:IP_Address or DNS name.


--
Sonat YAYLALI
btcozum.com


"it-support" <it-support@discussions.microsoft.com> wrote in message
newsDAEAD4A-8B61-4695-945E-D425E70E2A09@microsoft.com...

17:00 to 17:15 sounds real suspicious.. right when someone leaves at
5pm, turn off their power strip.

or,

janitor pulls plug out of wall, plugs in his floor polisher..

I've heard of both.. check these out as well as the other thing your
reply person said..

j.

it-support wrote:

thanks for the replies. But I dont see how they apply to my problem really.
Nice suggestion there on the Janitor unplugging the server but I think we
would notice if the server was constantly powered down, also it resides in a
fireproof security room where no Janitors are allowed.

Yali: "Synchronize the computer with the DC" I didnt write this at my first
post but this IS the DC I am talking about.

The DC is the server from which clients sync and set their time.

The DC is hooked up the ntp time servers which currently are: ntp1.sp.se,
ntp2.sp.se, time.umu.se.

These are all serious and competent companies where the first two are
controlled by the swedish government and gets their time from atom clocks.


Ive followed a basic w32time setup guide and pasted the results here:

Set the time servers:
net time /setsntp:"ntp1.sp.se ntp2.sp.se time.umu.se"

Stop Time Service:
net stop w32time

I set time 10 minutes off:
H:\>time
The current time is: 10:14:30,53
Enter the new time: 10:24 <-

Checking Time:
H:\>time
The current time is: 10:24:30,53
Enter the new time:
(yes, its of 10 minutes. ^c and abort)

Now I want to check time:
w32tm -once
(this command used to work on w2k, but seems to be unavailible in w2k3)

Instead I try this:
H:\>w32tm /resync /rediscover
Sending resync command to local computer...
The following error occurred: The interface is unknown. (0x800706B5)
Which gives me errors.

Both commands one at a time gives errors as well.
H:\>w32tm /resync
Sending resync command to local computer...
The following error occurred: The interface is unknown. (0x800706B5)
H:\>w32tm /resync /rediscover
Sending resync command to local computer...
The following error occurred: The interface is unknown. (0x800706B5)

So, I have to start the time service.

H:\>net start w32time
The Windows Time service is starting.
The Windows Time service was started successfully.
(yeeeey!)

Play it again Sam!
H:\>w32tm /resync /rediscover
Sending resync command to local computer...
The computer did not resync because no time data was available.

Err? Say what? First of all. Ive never specified the time service to sync
with local computer. And what more, well it doesnt work at all for sure.

Anyone knows what is wrong? I am still completely clueless why this
happends. It should be a problem! Again, the correct udp port is open.

Thanks.

"Brains,None" wrote: