Skip to content

Commit 7408f04

Browse files
author
Simonx Xu
committed
Update sts-recommendations-for-windows-server.md
1 parent d90abc6 commit 7408f04

1 file changed

Lines changed: 10 additions & 10 deletions

File tree

support/windows-server/active-directory/sts-recommendations-for-windows-server.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,17 +14,17 @@ keywords: Windows Time service, w32time, clock skew, NTP, STS, Secure Time Seedi
1414

1515
# Secure Time Seeding recommendations for Windows Server
1616

17-
This article provides recommendations for the Secure Time Seeding (STS) feature in Windows Server along with general good time synchronization practices.
17+
This article provides recommendations for the [Secure Time Seeding (STS)](/archive/blogs/w32time/secure-time-seeding-improving-time-keeping-in-windows) feature in Windows Server along with general good time synchronization practices.
1818

1919
## Brief summary
2020

21-
Customers have reported timekeeping issues in Windows Server 2016 and later Windows Server operating system (OS) deployments linked to the [Secure Time Seeding (STS)](/archive/blogs/w32time/secure-time-seeding-improving-time-keeping-in-windows) feature, due to its incompatibility with the affected deployments.
21+
Customers have reported timekeeping issues in Windows Server 2016 and later Windows Server operating system (OS) deployments linked to the Secure Time Seeding (STS) feature, due to its incompatibility with the affected deployments.
2222

23-
Based on customer reports and the associated feedback, we recommend the Secure Time Seeding (STS) feature to be disabled in your Windows Server 2016 and later Windows Server machines hosting time-sensitive workloads. This includes any Active Directory Domain Services (ADDS) domain controllers, virtual machine (VM) hosts, servers that use time for critical functionality or providing connectivity or as part of data processing in your deployments.
23+
Based on customer reports and the associated feedback, we recommend the Secure Time Seeding (STS) feature to be disabled in Windows Server 2016 and later Windows Server machines hosting time-sensitive workloads. This includes any Active Directory Domain Services (ADDS) domain controllers, virtual machine (VM) hosts, servers that use time for critical functionality or providing connectivity or as part of data processing in your deployments.
2424

25-
We recommend you consider disabling the STS feature in all your Windows Server 2016 and later Windows Server machines hosting generic/non-time-sensitive workloads to avoid unforeseen timekeeping-related incompatibility issues arising from STS.
25+
We recommend you consider disabling the STS feature in all Windows Server 2016 and later Windows Server machines hosting generic/non-time-sensitive workloads to avoid unforeseen timekeeping-related incompatibility issues arising from STS.
2626

27-
We recommend you review the timekeeping requirements for your Windows Server 2016 and later Windows Server OS deployments and ensure suitable time dissemination/synchronization and time monitoring are in place for Windows machines hosting time-sensitive workloads in your deployments, including any ADDS domain controllers and other potentially critical machines in your deployments.
27+
We recommend you review the timekeeping requirements for Windows Server 2016 and later Windows Server OS deployments and ensure suitable time dissemination/synchronization and time monitoring are in place for Windows machines hosting time-sensitive workloads in your deployments, including any ADDS domain controllers and other potentially critical machines in your deployments.
2828

2929
## Article overview
3030

@@ -218,9 +218,9 @@ Timekeeping and time synchronization are complex topics that are subjects of sev
218218

219219
- There's a large variety of customer networks and deployments, ranging from public internet access points, home networks to advanced private networks. We can generalize these into two broad categories - private/intra networks and public/inter networks - and examine possible time synchronization solutions for each category. This is a high-level abstract view of these deployments and readers are encouraged to treat the details presented here as such.
220220

221-
- Private networks often deploy local NTP time servers and distribute the time within the network.
221+
- Private networks often deploy local NTP time servers and distribute the time within the network.
222222

223-
- Public networks commonly use publicly accessible NTP servers to synchronize time (for example, `time.windows.com`).
223+
- Public networks commonly use publicly accessible NTP servers to synchronize time (for example, `time.windows.com`).
224224

225225
- An NTP server on your private network may be more accommodating to your needs than a public NTP server, but the latter may be readily accessible.
226226

@@ -232,19 +232,19 @@ Timekeeping and time synchronization are complex topics that are subjects of sev
232232

233233
- Some deployments may need redundancy of time servers to avoid any loss of availability. Relying on an odd number of comparable time servers (>1) can help meet this goal.
234234

235-
- Customers hosting time sensitive workloads should ensure their time distribution and monitoring in those environments meet their needs.
235+
- Customers hosting time sensitive workloads should ensure their time distribution and monitoring in those environments meet their needs.
236236

237237
- Once you have sufficient information about machines that host time sensitive workloads, time distribution topology and monitoring (including time monitoring) in your deployment, we suggest you gradually roll out disabling STS on Windows Server OS SKUs (various versions/editions), starting with the least significant machine to the most significant machine.
238238

239239
With this background on timekeeping and time synchronization, below is a set of suggested actions to review your deployment and change it, including disabling STS as previously recommended. This sample list must be tailored to suit your specific deployments.
240240

241241
- Review the time distribution/synchronization mechanisms you're using for timekeeping on your Windows Server OS machines.
242242

243-
- Determine if your deployment has time-sensitive workloads and determine the margin of acceptable time error. In general, larger time errors are easier to detect than smaller time errors.
243+
- Determine if your deployment has time-sensitive workloads and determine the margin of acceptable time error. In general, larger time errors are easier to detect than smaller time errors.
244244

245245
- Determine if you have a time monitoring mechanism in place on these machines to meet your timekeeping requirements. This could be an exclusive time monitoring system or a general monitoring solution that is deployed on each machine in this deployment.
246246

247-
- We suggest deploying time monitoring mechanisms if they're running time-sensitive workloads. Monitoring the System Event logs on a target machine for Kernel-General Event #1 is one possible way to sudden/large time changes (>1 second) or corrections. There are other ways of monitoring time, all of which are beyond the scope of this document. The higher the time accuracy your deployment needs, the more acute the need to deploy a monitoring solution.
247+
- We suggest deploying time monitoring mechanisms if they're running time-sensitive workloads. Monitoring the System Event logs on a target machine for Kernel-General Event #1 is one possible way to sudden/large time changes (>1 second) or corrections. There are other ways of monitoring time, all of which are beyond the scope of this document. The higher the time accuracy your deployment needs, the more acute the need to deploy a monitoring solution.
248248

249249
- Familiarize yourself with the STS feature and the recommendations in this document to disable STS.
250250

0 commit comments

Comments
 (0)