Time issues on the Network -- How to find the Root Cause

Question

A number of application servers started erroring out in my domain. Troubleshooting led me to a missconfiguration of NTP. I fixed the issue, but I don't know how the issue arose in the first place.

The only errors I can find are

System Error: 1097
Source: useenv

System Error: 1058
Source: useenv

System Error: 1030
Source: useenv

System Error: 1000
Source: mmc

How else can I find out why NTP started acting up on my domain? Is there any troubleshooting steps to diagnose why my DC started pulling from a random timeserver with the wrong time?

EDIT:

Current issue actually remains: the two 2003 DCs are not syncing with the PDC (a 2k8 box).

w32tm /resync -- The computer did not resync because no time data was available.

Answer 1

You can get the status of your 2008 DC time server:

w32tm /query /status /verbose


Leap Indicator: 0(no warning)
Stratum: 4 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.1093000s
Root Dispersion: 0.2018032s
ReferenceId: 0xABCDEFAB (source IP:  n.n.n.n)
Last Successful Sync Time: 11/18/2012 2:26:21 AM
Source: DCNAME.company.com
Poll Interval: 14 (16384s)

Phase Offset: -0.0027702s
ClockRate: 0.0156001s
State Machine: 2 (Sync)
Time Source Flags: 2 (Authenticated )
Server Role: 0 (None)
Last Sync Error: 0 (The command completed successfully.)
Time since Last Good Sync Time: 10651.6021203s  

You can use the NLTEST.exe command. The output includes the TIMESERV flag, which indicates the DC is advertising as a time server. DCDIAG should also indicate if the DC is advertising as a time server. Your other DC's will not sync with the 2008 DC if it isn't advertising.

nltest /server:DCNAME /dsgetdc:company.com  

           DC: \\DCNAME.company.com
      Address: \\n.n.n.n
     Dom Guid: 5fb09a11-8148-4d9c-a53a-d7a218880eaf
     Dom Name: company.com
  Forest Name: company.com
 Dc Site Name: SITENAME
Our Site Name: SITENAME
        Flags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS

The command completed successfully