Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Windows Time Service

Maintaining a correct computer time is important to security for two reasons. First, it is important that security events are recorded with the correct timestamp. If it is necessary to determine when something happened, or to match user logon times to events, it is important to be able to prove that the computer clock is accurate. Standalone Windows 2003 servers can be synchronized with an external timeserver using the Date and Time applet in the Control Panel or by using the net time command at the command line. (The time on Windows 2003 servers joined in a domain cannot be synchronized using this applet.) An external timeserver can be a reliable source on the network or a public timeserver on the Internet. If one Windows Server 2003 computer is synchronized with an external source, the rest of the Windows Server 2003 computers can be synchronized with it.

To set the server to synchronize with an external time source, follow these steps:

Open the Date and Time applet in the Control Panel.

Select the Internet Time tab.

Enter the Internet address for an accurate time source. The default is time.windows.com, a timeserver that is operated by Microsoft. You can change the timeserver name, but the timeserver must use NTP (RFC 1305). A timeserver that uses HTTP will not work.

WARNING: A Local Hardware-Based Time Clock May Be Required

It may be possible to spoof timeservers on the Internet. If your time service obtains the time from a fraudulent timeserver, no time-based process on the machine can be depended upon. To lessen the possibility of this happening, a hardware clock on the local network can be used. These clocks receive their time synchronization via radio waves and can become the source for computer time on your network. A list of these clocks can be found at http://www.boulder.nist.gov/timefreq/general/receiverlist.

The time service will attempt to synchronize once a week with the timeserver; however, if it is not connected to the Internet at this time, it will be unable to do so. To force synchronization of non-domain member Windows computers, click the Update Now button on the Internet Time tab of the Date and Time applet, as shown in Figure 2-9. (The Update Now button will not be available if your computer is a member of a domain.)

Synchronization failure can mean authentication failure, so be sure to determine why this is occurring and correct it. Synchronization failure may be due to several reasons:

The check box Automatically synchronize with an Internet time server is not checked.

The timeserver is busy or unavailable.

A firewall is blocking the use of the NTP.

The computer date is incorrect. Many Internet timeservers will not synchronize if the computer date is incorrect

You can also use the net time command or the W32tm command to establish the use of a specific timeserver. In the following command, computername stands for the name of the computer and timeserverlist represents a list of timeservers that can be used to obtain the correct time:

Net time \\computername    /setsntp:timeserverlist

Here, computername specifies the name of the computer to synchronize with and timeserverlist is the list of IP addresses or fully qualified domain names (separated by spaces) of servers to be used. If multiple timeservers are listed, the list must be enclosed in quotes. A list of timeservers available on the Internet can be located at http://boulder.nist.gov/timefreq/service/time-serversl. Both IP address and computer name are listed. For best results, use the IP address instead of the computer name in your configuration.

The following command, where domainname is the name of the domain, will synchronize the current computer with the time of the domain:

Net time /domain:domainname

The Windows Server 2003 time service is used to synchronize computer clock time for all computers in the forest. All computers in the forest will attempt to synchronize their clocks with the domain controller that holds the role of PDC emulator for their domain or with another domain controller. Domain controllers, in turn, attempt to synchronize with the PDC emulator in the root domain of the forest, although they can synchronize with other domain controllers. The PDC emulator in the root domain for the forest should be set to synchronize with an external time source or with a valid timeserver on the LAN.

Group Policy can be used to configure the time service of domain computers to use an alternative timeserver and to use the Windows server as a timeserver. For more information on the time service, see the white paper "Using Windows Time Service in a Managed Environment" at http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/ws03mngd/26_s3wts.mspx.