Why doesn't time synchronization with the domain work?

Question

Active Directory

Configured the server in AD ntp.
Here is the status from the server:

C:\Users\Администратор>w32tm /query /status
Индикатор помех: 0(предупреждений нет)
Страта: 1 (основная ссылка - синхронизирована по радиочасам)
Точность: -23 (119.209ns за такт времени)
Задержка корня: 0.0000000s
Дисперсия корня: 10.0000000s
Идентификатор опорного времени: 0x4C4F434C (имя источника:  "LOCL")
Время последней успешной синхронизации: 27.11.2020 9:52:14
Источник: Local CMOS Clock
Интервал опроса: 6 (64s)

Here is the configuration:

C:\Users\Администратор>w32tm /query /configuration
[Настройка]

EventLogFlags: 2 (Локально)
AnnounceFlags: 10 (Локально)
TimeJumpAuditOffset: 28800 (Локально)
MinPollInterval: 6 (Локально)
MaxPollInterval: 10 (Локально)
MaxNegPhaseCorrection: 172800 (Локально)
MaxPosPhaseCorrection: 172800 (Локально)
MaxAllowedPhaseOffset: 300 (Локально)

FrequencyCorrectRate: 4 (Локально)
PollAdjustFactor: 5 (Локально)
LargePhaseOffset: 50000000 (Локально)
SpikeWatchPeriod: 900 (Локально)
LocalClockDispersion: 10 (Локально)
HoldPeriod: 5 (Локально)
PhaseCorrectRate: 7 (Локально)
UpdateInterval: 100 (Локально)


[TimeProviders]

NtpClient (Локально)
DllName: C:\Windows\system32\w32time.dll (Локально)
Enabled: 1 (Локально)
InputProvider: 1 (Локально)
CrossSiteSyncFlags: 2 (Политика)
AllowNonstandardModeCombinations: 1 (Локально)
ResolvePeerBackoffMinutes: 15 (Политика)
ResolvePeerBackoffMaxTimes: 7 (Политика)
CompatibilityFlags: 2147483648 (Локально)
EventLogFlags: 0 (Политика)
LargeSampleSkew: 3 (Локально)
SpecialPollInterval: 1024 (Политика)
Type: NT5DS (Политика)

NtpServer (Локально)
DllName: C:\Windows\system32\w32time.dll (Локально)
Enabled: 1 (Локально)
InputProvider: 0 (Локально)
AllowNonstandardModeCombinations: 1 (Локально)

VMICTimeProvider (Локально)
DllName: C:\Windows\System32\vmictimeprovider.dll (Локально)
Enabled: 1 (Локально)
InputProvider: 1 (Локально)

I need the domain controller to use the server's local time (there is no access to an external source) and the local machines synchronize the time with the controller.

Here is the status from the remote machine:

C:\Users\ivanov.ivan.RDS.000>w32tm /query /status
Индикатор помех: 0(предупреждений нет)
Страта: 2 (вторичная ссылка - синхронизирована с помощью (S)NTP)
Точность: -6 (15.625ms за такт времени)
Задержка корня: 0.0010133s
Дисперсия корня: 13.8127846s
Идентификатор опорного времени: 0x656464C3 (IP-адрес источника:  101.100.100.195)
Время последней успешной синхронизации: 27.11.2020 10:21:03
Источник: WIN-AQLONANDMP0.rds.wr
Интервал опроса: 10 (1024s)

A PC that runs on Win-10 seems to sync normally, everything is OK .... But for some reason, a PC on Win-7 shows a time difference of 1 hour, i.e. on the server 10:30 and on the machine with Win-7 9:30 Why so? Or is it some kind of problem on a machine with Win-7?
And the 2nd question on the server itself, I can not change the system time if I click "Set time and date" on the right where the clock is, it says "Some settings are hidden or managed by your organization." How to change the time, I go to the server with administrator rights. I didn't find it in the AD settings.... Or is the time taken from the BIOS?

Answer 1

But for some reason, a PC on Win-7 shows a time difference of 1 hour, i.e. on the server 10:30 and on the machine with Win-7 9:30 Why so?

It looks like a problem with the time zone setting, or maybe it still changes to winter / summer time due to the lack of any updates.
I remember when the transition to winter / summer time was canceled in the Russian Federation, Microsoft released an update that made changes to the time zone settings.

I need the domain controller to use the server's local time (there is no access to an external source)

In this case, you need to start a separate PC on the network that is not part of the domain (so that it does not synchronize time with the controller), deploy NTPD on it and synchronize it with time from the Internet, and configure your controller to synchronize time with this PC. The easiest way is to install Linux on this PC, it will not be difficult to configure NTPD under it. Changing the time with your hands - well, this is ... bad, to put it mildly.