Server 2025 domain controller does not sync time if it advertises as a reliable time source and if source is "domhier"

Hello DJX995,

Thank you for posting in Q&A forum.

This is expected behavior.

In a Windows domain, the "reliable" flag (set with w32tm /config /reliable:yes) is normally used on the PDC emulator in the forest root when you want it to serve as the authoritative time source. When you mark a DC as “reliable”, you are telling it to view its local clock as authoritative and not to update its time from other sources (including the domain hierarchy). That’s why when you apply the flag on a secondary domain controller that normally syncs from its parent (“domhier”), it stops synchronizing its time and, without an external reliable source or proper external configuration, its time will eventually drift.

If the goal is to have a secondary DC serve as a reliable time source for clients at its site, you’ll need to ensure that:   

• It is configured to use an authoritative external time source (or its own reliable source), or   

• You upgrade its role in the time hierarchy appropriately (for example, designating it as the PDC emulator for that site if that fits your environment).

Marking a DC that is still set to sync from the domain hierarchy as “reliable” conflicts with how Windows Time Service is designed to work in an AD environment. The flag prevents it from syncing time (thus making it “authoritative”), which in this configuration causes the unexpected drifting behavior.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.