[Forgot Password]
Login  Register Subscribe

30430

 
 

423868

 
 

247862

 
 

909

 
 

194603

 
 

282

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-36308-5

Platform: win2012r2Date: (C)2015-10-08   (M)2022-10-10



Global Configuration Settings These settings control the Windows Time service (W32time) for domain controllers. Several of these values are scalar, which means that they only have meaning in relation to one another and are not defined by specific unit measurements. For settings regarding time sync for domain member computers, see Configure a client computer for automatic domain time synchronization (http://go.microsoft.com/fwlink/?LinkId=139706). Clock discipline parameters FrequencyCorrectRate: Controls the rate at which the W32time corrects the local clock's frequency. Lower values cause slower corrections; larger values cause quicker corrections. Values that are too low can lead to overcorrection and instability. Values that are too high can lead to slow synchronization. Default: 4 (scalar). HoldPeriod: Indicates how many potentially accurate time samples the client must receive in a series before subsequent time samples are evaluated as potential spikes. After a period of not receiving any usable time samples, a time client ceases to evaluate time samples for spikes as soon as the first potentially accurate time sample is received. When a series of time samples (as indicated by HoldPeriod) is received, the time client evaluates subsequent time samples for spikes. A time sample is considered to be a spike when the time difference between a time sample and the client's local clock is greater than that of the LargePhaseOffset value. Default: 5 time samples. LargePhaseOffset: Specifies the time variation from the client's local clock (phase offset) that a time sample must have to be considered a spike. Time samples that have time variations larger than the LargePhaseOffset value are considered spikes. Default: 50,000,000 100-nanosecond units (ns), which is 5 seconds. MaxAllowedPhaseOffset: Controls how W32time corrects the clock based on the size of the calculated time variation between the time sample and the client's local clock. If a response is received that has a time variation that is larger than this value, W32time sets the client's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client's local clock is corrected gradually. Default: 300 seconds. MaxNegPhaseCorrection: Controls the maximum allowable clock correction that can be made in a reverse direction. If a time sample is received that indicates a time in the past (as compared to the client's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. If this happens, the Windows Time source logs an event in the System log of Event Viewer. Default: 172,800 seconds. MaxPosPhaseCorrection: Controls the maximum allowable clock correction that can be made in a forward direction. If a time sample is received that indicates a time in the future (as compared to the client's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. PhaseCorrectRate: Controls how quickly W32time corrects the client's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more slowly; larger values cause the clock to correct more quickly. Default: 7 (scalar). PollAdjustFactor: Controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar). SpikeWatchPeriod: Specifies the amount of time that suspicious time samples are received from a time source before these time samples are accepted as accurate. Time samples are considered suspicious when the time difference between the time sample and the client's local clock is larger than the value of LargePhaseOffset. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds. UpdateInterval: Specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, which is 1 second. General parameters: AnnounceFlags: A bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal. For possible values, see Config\AnnounceFlags Entry (http://go.microsoft.com/fwlink/?LinkId=139718). EventLogFlags: Controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask. For possible values, see NtpClient\EventLogFlags Subkey (http://go.microsoft.com/fwlink/?LinkId=139720). LocalClockDispersion: Indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds. MaxPollInterval: Controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, which is 1,024 seconds. (Should not be set higher than 15.) MinPollInterval: Controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, which is 64 seconds. RODC parameters: For additional information about these settings, see Appendix A: Technical Reference Topics (http://go.microsoft.com/fwlink/?LinkID=128273). ChainEntryTimeout: Specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds. ChainMaxEntries: Controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries. ChainMaxHostEntries: Controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries. ChainDisable: Controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean. ChainLoggingRate: Controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes.


Parameter:


Technical Mechanism:

(1) GPO: Computer Configuration\Administrative Templates\System\Windows Time Service!Global Configuration Settings (2) WMI: ###

CCSS Severity:CCSS Metrics:
CCSS Score : Attack Vector:
Exploit Score: Attack Complexity:
Impact Score: Privileges Required:
Severity: User Interaction:
Vector: Scope:
 Confidentiality:
 Integrity:
 Availability:
  

References:
Resource IdReference


XCCDF    1

© SecPod Technologies