Set External Time Source for Windows Server 2016/2019 Domain

Here’s how to find out where your Windows Server 2016 domain controller (and the domain as a whole) is syncing its time from.

1. Check the Current Time Source on the DC

Open Command Prompt or PowerShell as Administrator and run:

w32tm /query /status

You’ll get output like this:

Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0414518s
Root Dispersion: 10.1234567s
ReferenceId: 192.168.1.10
Last Successful Sync Time: 2025-11-08 01:23:45
Source: time.windows.com,0x9
Poll Interval: 10 (1024s)

2. Check Domain-Wide Time Hierarchy

In an Active Directory domain, time synchronization flows like this:

PDC Emulator (Primary Domain Controller) in the forest root domain → syncs with an external NTP source (like time.windows.com or a GPS/NTP appliance).
All other domain controllers → sync with the PDC Emulator.
All domain-joined clients and servers → sync with their authenticating DC.

To see which DC is the PDC Emulator, run:

netdom query fsmo

You’ll see:

Schema master               dc01.dox.local
Domain naming master        dc01.dox.local
PDC                         dc01.dox.local
RID pool manager            dc01.dox.local
Infrastructure master       dc02.dox.local

The PDC listed here is the authoritative time source for your domain.

3. Check What Time Source the Domain Uses

On the PDC Emulator, run:

w32tm /query /source

If it says:

Source: Local CMOS Clock

That means your domain isn’t syncing with an external NTP source (it’s using the server’s local clock — not ideal).

4. See the Full Time Configuration

Run this on the PDC:

w32tm /query /configuration

You’ll get details like:

[TimeProviders]
NtpClient (Local)
    Enabled: 1
    NtpServer: time.nrc.ca,0x8
    CrossSiteSyncFlags: 2
    ResolvePeerBackoffMinutes: 15

5. Configure the PDC to Use an External NTP Source

If you find it’s using the local CMOS clock, configure a proper source:

w32tm /config /manualpeerlist:"0.ca.pool.ntp.org 1.ca.pool.ntp.org" /syncfromflags:manual /reliable:yes /update
net stop w32time && net start w32time

Then check again:

w32tm /query /status

Check Clients and Other DCs

On any domain-joined machine:

w32tm /query /source

You’ll likely see:

Source: DC01.dox.local

Set Official Canadian Time Source

National Research Council of Canada

time.nrc.ca and time.chu.nrc.ca

Reference:

https://nrc.canada.ca/en/certifications-evaluations-standards/canadas-official-time/network-time-protocol-ntp