Which domain controller role is responsible for time synchronization within the domain and forest?

Which domain controller role is responsible for time synchronization within the domain and forest?

• A. RID Master
• B. Domain Naming Master
• C. Schema Master
• D. PDC Emulator

Answer: (D)

The PDC Emulator is the time source for the domain. In Windows domains, the Windows Time service uses a hierarchical model where the PDC Emulator of a domain acts as the authoritative time provider for that domain (and, in a forest, the root domain’s PDC Emulator provides forest-wide time authority). This PDC Emulator should synchronize with a reliable external time source (such as an NTP server), and then all other domain controllers and domain-joined clients synchronize their clocks to it. This arrangement helps keep Kerberos authentication and other time-sensitive services in sync, since Kerberos tickets have strict clock skew requirements. The other domain controller roles—RID Master, Domain Naming Master, and Schema Master—handle resource and schema operations, not time synchronization, so they don’t influence time distribution within the domain or forest.

The PDC Emulator is the time source for the domain. In Windows domains, the Windows Time service uses a hierarchical model where the PDC Emulator of a domain acts as the authoritative time provider for that domain (and, in a forest, the root domain’s PDC Emulator provides forest-wide time authority). This PDC Emulator should synchronize with a reliable external time source (such as an NTP server), and then all other domain controllers and domain-joined clients synchronize their clocks to it. This arrangement helps keep Kerberos authentication and other time-sensitive services in sync, since Kerberos tickets have strict clock skew requirements.

The other domain controller roles—RID Master, Domain Naming Master, and Schema Master—handle resource and schema operations, not time synchronization, so they don’t influence time distribution within the domain or forest.