You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/windows-server/active-directory/sts-recommendations-for-windows-server.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,17 +14,17 @@ keywords: Windows Time service, w32time, clock skew, NTP, STS, Secure Time Seedi
14
14
15
15
# Secure Time Seeding recommendations for Windows Server
16
16
17
-
This article provides recommendations for the Secure Time Seeding (STS) feature in Windows Server along with general good time synchronization practices.
17
+
This article provides recommendations for the [Secure Time Seeding (STS)](/archive/blogs/w32time/secure-time-seeding-improving-time-keeping-in-windows) feature in Windows Server along with general good time synchronization practices.
18
18
19
19
## Brief summary
20
20
21
-
Customers have reported timekeeping issues in Windows Server 2016 and later Windows Server operating system (OS) deployments linked to the [Secure Time Seeding (STS)](/archive/blogs/w32time/secure-time-seeding-improving-time-keeping-in-windows) feature, due to its incompatibility with the affected deployments.
21
+
Customers have reported timekeeping issues in Windows Server 2016 and later Windows Server operating system (OS) deployments linked to the Secure Time Seeding (STS) feature, due to its incompatibility with the affected deployments.
22
22
23
-
Based on customer reports and the associated feedback, we recommend the Secure Time Seeding (STS) feature to be disabled in your Windows Server 2016 and later Windows Server machines hosting time-sensitive workloads. This includes any Active Directory Domain Services (ADDS) domain controllers, virtual machine (VM) hosts, servers that use time for critical functionality or providing connectivity or as part of data processing in your deployments.
23
+
Based on customer reports and the associated feedback, we recommend the Secure Time Seeding (STS) feature to be disabled in Windows Server 2016 and later Windows Server machines hosting time-sensitive workloads. This includes any Active Directory Domain Services (ADDS) domain controllers, virtual machine (VM) hosts, servers that use time for critical functionality or providing connectivity or as part of data processing in your deployments.
24
24
25
-
We recommend you consider disabling the STS feature in all your Windows Server 2016 and later Windows Server machines hosting generic/non-time-sensitive workloads to avoid unforeseen timekeeping-related incompatibility issues arising from STS.
25
+
We recommend you consider disabling the STS feature in all Windows Server 2016 and later Windows Server machines hosting generic/non-time-sensitive workloads to avoid unforeseen timekeeping-related incompatibility issues arising from STS.
26
26
27
-
We recommend you review the timekeeping requirements for your Windows Server 2016 and later Windows Server OS deployments and ensure suitable time dissemination/synchronization and time monitoring are in place for Windows machines hosting time-sensitive workloads in your deployments, including any ADDS domain controllers and other potentially critical machines in your deployments.
27
+
We recommend you review the timekeeping requirements for Windows Server 2016 and later Windows Server OS deployments and ensure suitable time dissemination/synchronization and time monitoring are in place for Windows machines hosting time-sensitive workloads in your deployments, including any ADDS domain controllers and other potentially critical machines in your deployments.
28
28
29
29
## Article overview
30
30
@@ -218,9 +218,9 @@ Timekeeping and time synchronization are complex topics that are subjects of sev
218
218
219
219
- There's a large variety of customer networks and deployments, ranging from public internet access points, home networks to advanced private networks. We can generalize these into two broad categories - private/intra networks and public/inter networks - and examine possible time synchronization solutions for each category. This is a high-level abstract view of these deployments and readers are encouraged to treat the details presented here as such.
220
220
221
-
- Private networks often deploy local NTP time servers and distribute the time within the network.
221
+
- Private networks often deploy local NTP time servers and distribute the time within the network.
222
222
223
-
- Public networks commonly use publicly accessible NTP servers to synchronize time (for example, `time.windows.com`).
223
+
- Public networks commonly use publicly accessible NTP servers to synchronize time (for example, `time.windows.com`).
224
224
225
225
- An NTP server on your private network may be more accommodating to your needs than a public NTP server, but the latter may be readily accessible.
226
226
@@ -232,19 +232,19 @@ Timekeeping and time synchronization are complex topics that are subjects of sev
232
232
233
233
- Some deployments may need redundancy of time servers to avoid any loss of availability. Relying on an odd number of comparable time servers (>1) can help meet this goal.
234
234
235
-
- Customers hosting time sensitive workloads should ensure their time distribution and monitoring in those environments meet their needs.
235
+
- Customers hosting time sensitive workloads should ensure their time distribution and monitoring in those environments meet their needs.
236
236
237
237
- Once you have sufficient information about machines that host time sensitive workloads, time distribution topology and monitoring (including time monitoring) in your deployment, we suggest you gradually roll out disabling STS on Windows Server OS SKUs (various versions/editions), starting with the least significant machine to the most significant machine.
238
238
239
239
With this background on timekeeping and time synchronization, below is a set of suggested actions to review your deployment and change it, including disabling STS as previously recommended. This sample list must be tailored to suit your specific deployments.
240
240
241
241
- Review the time distribution/synchronization mechanisms you're using for timekeeping on your Windows Server OS machines.
242
242
243
-
- Determine if your deployment has time-sensitive workloads and determine the margin of acceptable time error. In general, larger time errors are easier to detect than smaller time errors.
243
+
- Determine if your deployment has time-sensitive workloads and determine the margin of acceptable time error. In general, larger time errors are easier to detect than smaller time errors.
244
244
245
245
- Determine if you have a time monitoring mechanism in place on these machines to meet your timekeeping requirements. This could be an exclusive time monitoring system or a general monitoring solution that is deployed on each machine in this deployment.
246
246
247
-
- We suggest deploying time monitoring mechanisms if they're running time-sensitive workloads. Monitoring the System Event logs on a target machine for Kernel-General Event #1 is one possible way to sudden/large time changes (>1 second) or corrections. There are other ways of monitoring time, all of which are beyond the scope of this document. The higher the time accuracy your deployment needs, the more acute the need to deploy a monitoring solution.
247
+
- We suggest deploying time monitoring mechanisms if they're running time-sensitive workloads. Monitoring the System Event logs on a target machine for Kernel-General Event #1 is one possible way to sudden/large time changes (>1 second) or corrections. There are other ways of monitoring time, all of which are beyond the scope of this document. The higher the time accuracy your deployment needs, the more acute the need to deploy a monitoring solution.
248
248
249
249
- Familiarize yourself with the STS feature and the recommendations in this document to disable STS.
0 commit comments