AntennaPilot

AntennaPilot

Correct time on every PC on board when the ship changes time zone

Keep every Windows PC on board on the same time: why you change the zone and not the clock, which zones to use, and how to check the domain time hierarchy.

A ship changes its clocks every day or two on some voyages. If every PC is changed by hand, after a month the bridge PC, the engine control room PC and the firewall all show different times, logs no longer line up, and domain logons start failing. The fix is a simple rule and a correct time hierarchy.

Change the zone, never the clock

Windows keeps its clock in UTC and shows local time through the time zone setting. When the ship advances its clocks by one hour, the UTC time does not change; only the zone does. Setting the clock by hand instead moves UTC, and once it is more than five minutes away from the domain controller, Kerberos authentication fails and users cannot log on.

From an administrator command prompt:

tzutil /g
tzutil /l
tzutil /s "Zone ID"

/g shows the current zone, /l lists the zone IDs, /s sets one. Use the ID exactly as /l prints it.

Use zones without daylight saving

A ship's time is a fixed offset from UTC decided by the master. A political zone with daylight saving (a European or American city) will move by an hour on its own on the changeover date, wherever the ship is. Choose a zone that has no daylight saving and the offset you need, and check it with tzutil /l before you roll it out.

One time source, one hierarchy

In an Active Directory domain the correct layout is:

  1. The ship's GPS time server (an NTP server fed by the GPS) is the reference.
  2. The domain controller with the PDC emulator role takes its time from it.
  3. Every other domain PC and server takes its time from the domain hierarchy.

On the PDC emulator (replace the address with your NTP server):

w32tm /config /manualpeerlist:"192.0.2.10,0x8" /syncfromflags:manual /reliable:yes /update
w32tm /resync /rediscover

On the other domain members:

w32tm /config /syncfromflags:domhier /update
w32tm /resync

To check a PC:

w32tm /query /source
w32tm /query /status
w32tm /stripchart /computer:192.0.2.10 /samples:5 /dataonly

A source of "Local CMOS Clock" or "Free-running System Clock" means the PC is not synchronising with anything.

Where it usually goes wrong

  • PCs that are not in the domain, such as bridge or engine PCs installed by a supplier, keep their own clock and zone.
  • Someone set a clock by hand two contracts ago, and that PC has drifted ever since.
  • Firewalls, switches and cameras use their own NTP settings; point them to the same GPS time server.
  • The zone change is done at different times on different PCs. Schedule it, and do it everywhere at once.

Doing it with EightBells and Wakeline

EightBells Fleet Time Manager reads the zone, clock, drift and NTP source of every Windows PC in the domain from one admin PC over WinRM, without agents. It sets the zone on all PCs at once or at a scheduled time, uses a maritime list of zones without daylight saving, and puts the domain controller and the other PCs back on the correct hierarchy. For the time source itself, the Wakeline server reads the time from the bridge GPS over NMEA and serves it by NTP to the whole network, even when the internet is down.

All shipboard IT guides · Razvan Malciu, shipboard IT officer