In an Active Directory domain, a strict hierarchical time synchronization scheme is used:
🔹 The PDC Emulator in the root domain is the primary time source for the domain
🔹 Other domain controllers (DCs) synchronize their time from the PDC Emulator
🔹 Domain-joined workstations and member servers get their time from the nearest domain controller
⚙️ By default, the PDC syncs its time with the local CMOS (hardware) clock of the physical server (or the hypervisor CMOS if it's running in a VM). If the hardware clock is inaccurate, it can cause problems with authentication and interaction with external systems.
That's why you should configure the PDC to synchronize with a reliable external NTP time source and disable synchronization with the local hardware clock/hypervisor.
✅ In this article, we look at how to properly configure time synchronization in an Active Directory domain and what to do if something isn't working correctly.
Configuring Time Synchronization in an Active Directory Domain
