Windows Time Sync Registry set Up

This script needs to be run as an administrator and it will modify registry.
The primary domain controller will sync time externally from pool.ntp.org while the seconday dc’s will sync time from the primary (which has PDc emulater role.)

<# 
Windows Time Sync Registry set up 
By allenage.com DC time sync v 0.1
Final Update on 6/19/2017


##########################****** Configuration Info *********####################################
# Peers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\NTPServer=pool.ntp.org,0x1
We are setting Pool.ntp.org,0x1 Check your region if you would set your own http://www.pool.ntp.org/zone/@

# interval
0x01 SpecialInterval
0x02 UseAsFallbackOnly
0x04 SymmetricActive
0x08 Client
0x9 which uses DNS round robin to make a random selection from a pool of time servers.


# For PDC Announce flag 5 and backup domain controllers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags=5
This entry controls whether this computer is marked as a reliable time server. A computer is not marked as reliable unless it is also marked as a time server.
0x00 Not a time server
0x01 Always time server
0x02 Automatic time server
0x04 Always reliable time server
0x08 Automatic reliable time server
The default value for domain members is 10. The default value for stand-alone clients and servers is 10.

# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type=NTP
this entry indicates which peers to accept synchronization from:

NoSync. The time service does not synchronize with other sources.
NTP. The time service synchronizes from the servers specified in the NtpServer. registry entry.
NT5DS. The time service synchronizes from the domain hierarchy.
AllSync. The time service uses all the available synchronization mechanisms.

##########################****** Configuration Info *********####################################



Important psremoting needs to be enabled.

run  Enable-PSRemoting -Force on PowerShell elevated mode to enable Psremoting.

This script needs to be run as an administrator and it will modify registry.
The primary domain controller will sync time externally from pool.ntp.org while the secondary dc's will sync time from the primary (which has PDc emulator role.)

Later you can type Dcdiag to check Advertising test.

#> 

 
 If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
 {    
  Write-Host "This script needs to be run As Admin go back and Run as admin" -BackgroundColor red
Start-Sleep -Seconds 5
Exit
 }

Write-host "Enabling Psremoting on this Computer $env:computername" -ForegroundColor Green

Enable-PSRemoting -Force

import-module activedirectory

$pdc=Get-ADDomainController -Discover -Service PrimaryDC |select -ExpandProperty name
$PDCSYNC = { w32tm /config /manualpeerlist:"pool.ntp.org,0x1" /syncfromflags:manual /reliable:yes /update
w32tm /config /update
Restart-Service w32time
w32tm /resync /rediscover
w32tm /resync
}

# Registry Modifications for PDC so It advertise as Time server
$aflags={Set-ItemProperty -path "HKLM:\system\CurrentControlSet\Services\W32Time\Config" -Name AnnounceFlags -Value 5 -Type DWord -Force}
$ntp1={Set-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" -Name Type -Value NTP  -Force }
$Vmic={Set-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider" -Name Enabled -Value 0 -Type DWord -Force}

Invoke-Command -ComputerName $pdc -ScriptBlock $PDCSYNC
Invoke-Command -ComputerName $pdc -ScriptBlock $aflags
Invoke-Command -ComputerName $pdc -ScriptBlock $ntp1
Invoke-Command -ComputerName $pdc -ScriptBlock $Vmic
$dc=Get-ADDomainController -filter * |?{$_.OperationMasterRoles -notcontains 'PDCEmulator'} |select -ExpandProperty name

# commands for DC to sync from primary
$dcupdate={w32tm /config /syncfromflags:domhier /update}
$advtest1={Set-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider" -Name Enabled -Value 0 -Type DWord -Force}
$advtest2={Set-ItemProperty -path "HKLM:\system\CurrentControlSet\Services\W32Time\Config" -Name AnnounceFlags -Value 10 -Type DWord -Force}
$ntp2={Set-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" -Name Type -Value NT5DS  -Force }
$Advtest3={restart-service w32time}
$advtest4={w32tm /resync /rediscover}
$advtest5={w32tm /resync}
if($dc -like '*')
{
Invoke-Command -ComputerName $dc -ScriptBlock $dcupdate
Invoke-Command -ComputerName $dc -ScriptBlock $Advtest1
Invoke-Command -ComputerName $dc -ScriptBlock $Advtest2
Invoke-Command -ComputerName $dc -ScriptBlock $ntp2
Invoke-Command -ComputerName $dc -ScriptBlock $Advtest3
Invoke-Command -ComputerName $dc -ScriptBlock $Advtest4
Invoke-Command -ComputerName $dc -ScriptBlock $Advtest5
}
else

{
write-host "You have only one domain controller"
}