PowerStore: Time services does not sync with Windows Server NTP service if root dispersion is greater than 5 seconds

An error similar to this might be observed during the Initial Configuration Wizard (ICW):

Issue: The time between vCenter and PowerStore has diverged for 27 seconds. (0xE0E700200002)
Resolution: Synchronize the time between your vCenter server and PowerStore.

Or an alert with error codes 0x01806d02, 0x01806d03 or 0x01806c02 might be observed after adding a NTP server

Alert id       : [...]
Error Code     : 0x01806d02
Severity       : Minor
Timestamp (UTC): 2022-07-01 13:40:35+00
Appliance Name : PowerStore-1
Resource Type  : node
Resource Name  : PowerStore-1-node-B
Description    : Time difference between the node and the following NTP servers exceeds system requirements: ntp.domain.local - 5.89 sec., ntp01.domain.local - 5.89 sec..

Running the following on the windows server running NTP services shows root dispersion greater than 10:

w32tm /query /status

C:\Users\example> w32tm /query /status
Leap Indicator: 0(no warning)
Stratum: 4 (secondary reference - syncd by (S)NTP)
Precision: -23 (119.209ns per tick)
Root Delay: 0.1015253s
Root Dispersion: 10.7922013s
ReferenceId: 0x0A181B1B (source IP:  xx.xx.xx.xx)
Last Successful Sync Time: 30/03/2022 07:48:15
Source: xx.xx.xx.xx
Poll Interval: 6 (64s)

This lists all NTP servers that must be investigated:

w32tm /query /peers

C:\Users\example> w32tm /query /peers
#Peers: 1

Peer: xx.xx.xx.xx
State: Active
Time Remaining: 52.0325146s
Mode: 1 (Symmetric Active)
Stratum: 3 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 6 (64s)
HostPoll Interval: 6 (64s)

---

1. The Windows NTP servers are not configured to use a valid external clock source (such as atomic, GNSS, or radio clocks), or
2. The Windows NTP servers do not have a valid upstream or reliable external NTP source, or
3. Upstream requests are blocked by your firewall.

---

1) Open port 123 (UDP) in the firewall to allow windows NTP to communicate with time.windows.com or to a valid external NTP source.


2) Alternatively, once the firewall rule is implemented, configure a different valid time server, replacing "ntp_server" below with a valid hostname:

w32tm /config /manualpeerlist:"ntp_server" /syncfromflags:manual /reliable:yes /update

3) If a valid clock source (quartz / atomic clock / GPS clock) cannot be attached to your NTP server, or a valid upstream NTP server cannot be configured or the ports cannot be opened, you may consider changing these registry values:

HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config
LocalClockDispersion = 1
AnnounceFlags = 0x05

NOTE: by implementing a forced LocalClockDispersion, you are accepting the consequences of a potential unreliable time source for your internal devices. The recommendation is to attach instead atomic, GNSS, or radio clock devices to your lowest stratum 1 server within a fully isolated domain.

4) If the Windows Time Services are running as a VM, ensure that Hyper-V or VMware tools are not also setting the time, so that only one reliable clock source exists.

References:

Disable Time Sync in ESXi (see https://kb.vmware.com/s/article/1189):


In Hyper-V:



5) Restart and resync windows time services:

net stop w32time
net start w32time
w32tm /resync /rediscover

 

---

Microsoft references:
- https://docs.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings
- https://docs.microsoft.com/en-us/windows-server/networking/windows-time-service/configuring-systems-for-high-accuracy

Virtualizing Active Directory Domain Services on VMware vSphere:
https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/solutions/virtualizing-active-directory-domain-services-on-vmware-vsphere.pdf