Time Server

There were some posts on this a little while back.

We run this as part of a post image script among a few other things at reboot. We took binding out of the imaging configurations as we were having this issue.

To bind machines, the last line of our post image script (after time is set and a few other things) is sudo jamf policy -trigger bindings where bindings is a custom policy trigger that binds to domain

<<We also used a simpler script in past years, but it wasn't working this year (10.6)

#set date, time asap

TIMEZONE="America/New_York"

TIMESERVER="timeserver"

SetDateAndTime () {

systemsetup -settimezone "$TIMEZONE"

systemsetup -setusingnetworktime off

#backing up old NTP config

mv /private/etc/ntp.conf /private/etc/ntp.conf.date +%Y-%m-%d_%H.%M.%S

echo "server $TIMESERVER" > /private/etc/ntp.conf

systemsetup -setusingnetworktime on

sleep 5 #let the clock change before running date

date > /Library/Logs/CurrentTimeBeforeBind.log

}

SetDateAndTime

In my opinion, if your company runs a domain server without a corresponding time server, that is a very big problem. I strongly recommend insisting that that server be made available, as you're looking at a lot of issues down the road otherwise.

+1 concur.

As anything kerberos-based (including AD) is very time sensitive your DCs
or FR should be running their own time service. Even if their time isn't
the real-world time (does a few minutes really matter?) the biggest thing
is that everything can agree on just what time it is. You can be 12 hours
off of the real-world time but as long as everything is 12 hours off of
that time and agrees, you're good.

j
-- Jared F. Nichols
Desktop Engineer, Client Services
Information Services Department
MIT Lincoln Laboratory
244 Wood Street
Lexington, Massachusetts 02420
781.981.5436

It also depends on the time server used by the preferred dc.

We don't change here, but have clients hoping between countries & all is fine.

Regards,

Ben Toms

We have a time server, but it's internal and not accessible from the
outside world. We also block apple's default TS for whatever reason.

John Wojda
Lead System Engineer, DEI
3333 Beverly Rd. B2-338B
Hoffman Estates, IL 60179
Phone: (847)286-7855
Page: (224)532.3447
Team Lead: Matt Beiriger

If the time server is not accessible to the outside world, the domain controller probably isn't either. At least I hope not. But anywhere you can bind, you should be able to sync.

Interesting...

I have an internal time server configured, and I had the same issue with
new out-of-box systems.

I just built my base OS image with our time server already set, and that
took care of my binding issue.

Russell Shehan MCTS, ACTC
Operations Administrator
Hartland-Lakeside School District
Office: 262-369-6736
Cell: 262-949-2439
http://www.hartlake.org

As suggested, you need an internal time server(s) that all your machines can reference and then you can just use a command in a simple script to point your machines at the necessary clock server(s).

There are various ways you could grab your domain in a script, but you can just use 'hostname'. [machinename].[domain]

Then you can use the following to set the server
systemsetup -setnetworktimeserver [domain]

Sean

If your NTP server is not accessible off site/campus and your users
take their laptops off site all the time, a little script with launchd
could check if you were inside or outside the network then set the time
server accordingly.