Time / NTP
Check the time source and clock skew: the basis for Kerberos and TLS.
Time source and status
Shows where the system gets its time from and whether synchronisation is working.
PowerShell (Windows)
w32tm Built-in
w32tm /query /status
w32tm /query /sourceGet-Date Built-in
Get-Date -Format o
Get-TimeZoneUnix shell (bash)
timedatectl Built-in
timedatectl statuschronyc / ntpq Add-on tool
chronyc tracking
ntpq -pA domain member takes its time from the domain controller; only the PDC emulator uses an external source.
Check a time server
Queries a time server and shows the offset per sample.
- Time server
-
ch.pool.ntp.orgChange in the builder →
PowerShell (Windows)
w32tm Built-in
w32tm /stripchart /computer:ch.pool.ntp.org /samples:5 /dataonlyw32tm peers Built-in
w32tm /query /peersUnix shell (bash)
timedatectl Built-in
timedatectl show-timesync --allchronyc / ntpdate Add-on tool
chronyc sources -v
ntpdate -q ch.pool.ntp.orgClock skew against a host
Compares your clock with another system's: more than five minutes of skew breaks Kerberos.
- Host / server
-
mail.example.comChange in the builder →
PowerShell (Windows)
Invoke-Command / w32tm Built-in
w32tm /stripchart /computer:mail.example.com /samples:3 /dataonly
# Grosser Versatz bricht Kerberos (Standard: max. 5 Minuten).net time Add-on tool
net time \\mail.example.comUnix shell (bash)
date / curl Built-in
date -u
curl -sI https://mail.example.com | grep -i "^date:"
# Beide Zeiten vergleichen: grosser Versatz bricht Kerberos und TLS-Pruefungen.ntpdate Add-on tool
ntpdate -q mail.example.comThe clock matters for mail too: a large skew makes certificates look "not yet valid" and shifts the timestamps in the headers.
Resynchronise time
Sets the time source and forces an immediate synchronisation.
- Time server
-
ch.pool.ntp.orgChange in the builder →
PowerShell (Windows)
w32tm Built-in
w32tm /config /manualpeerlist:"ch.pool.ntp.org" /syncfromflags:manual /update
Restart-Service w32time
w32tm /resync /forceGet-Service Built-in
Get-Service w32time | Format-List Status, StartTypeUnix shell (bash)
timedatectl Built-in
sudo timedatectl set-ntp true
timedatectl timesync-statuschronyc Add-on tool
sudo chronyc makestep
chronyc sourcesChanges the system configuration; on a domain controller, only run it deliberately and with the time hierarchy in mind.
