The hierarchy is designed to provide a consistent time source without requiring every computer to be configured individually. Workstations and member servers obtain time from domain controllers, domain controllers follow the hierarchy for their domain, and the hierarchy ultimately leads to the PDC Emulator in the forest root domain.
This behaviour is important because Active Directory depends on computers agreeing closely enough on the current time. Kerberos authentication, replication, certificates and event correlation can all be affected when clocks differ significantly.
Domain members
A domain-joined workstation or member server normally uses the NT5DS synchronisation type. This tells Windows Time Service to obtain time from the Active Directory domain hierarchy rather than from a manually specified Internet NTP server.
The computer discovers an appropriate domain controller through the normal domain location process. It is not necessary for every member computer to use the same domain controller, and a member should not normally be configured to point directly at the PDC Emulator.
Using the hierarchy allows Windows to select an available domain controller while preserving the chain back to the authoritative source. It also avoids creating a dependency in which every workstation and server contacts one domain controller directly.
Domain controllers
Domain controllers also select time sources through the domain hierarchy. They prefer sources that are considered more authoritative and avoid synchronising from themselves or creating circular relationships.
The PDC Emulator role holder is significant within each domain. Other domain controllers can trace their time back towards that role holder, while the PDC Emulator for a child domain follows the hierarchy into its parent domain.
In a single-domain forest, the domain PDC Emulator is also the forest root PDC Emulator. In a multi-domain forest, each domain has its own PDC Emulator, but only the PDC Emulator in the forest root domain sits at the top of the complete hierarchy.
The forest root PDC Emulator
The PDC Emulator in the forest root domain is the authoritative time source for the forest. Unlike the systems below it, this server cannot obtain time by continuing further up the Active Directory hierarchy because no higher domain exists.
It should therefore be configured to use a reliable external source. This may be a public NTP service, an organisation's own network time appliance or an internal GPS-backed NTP server.
The external source should be configured on the role holder rather than on a server name chosen permanently for that purpose. If the PDC Emulator role is transferred or seized, the time configuration must be reviewed on both the new and previous role holders.
The new forest root PDC Emulator must be configured to use the external source. The previous role holder should normally be returned to domain hierarchy synchronisation so that it behaves like the other domain controllers.
How the hierarchy fits together
In a single-domain forest, the normal path is straightforward:
Domain member → domain controller → forest root PDC Emulator → external time source
A multi-domain forest adds another level. A member in a child domain obtains time from a domain controller in that domain. The child-domain hierarchy leads to its PDC Emulator, which then follows the hierarchy towards the parent domain and ultimately the forest root PDC Emulator.
The exact server selected at each stage may vary. The important point is not that every system follows one fixed list of computer names, but that all valid paths lead upwards through the Active Directory hierarchy towards the same authoritative source.
Why manually overriding the hierarchy causes problems
It is possible to configure domain members or domain controllers with explicit NTP servers, but doing so without a specific design requirement bypasses the normal Active Directory behaviour.
For example, configuring every domain controller with a different external source can cause them to disagree about which clock is authoritative. Configuring all workstations to use an Internet source removes the relationship between the clients and the domain hierarchy. Applying the same NTP policy indiscriminately to every Windows computer can also overwrite the special configuration required by the forest root PDC Emulator.
These configurations may appear to work while all sources are reachable and closely aligned. The weakness becomes apparent when an external source fails, a firewall rule changes, a PDC Emulator role is transferred or two sources begin reporting different time.
The default hierarchy should therefore be retained unless there is a documented reason to replace it with a deliberately designed alternative.
Checking the hierarchy
The hierarchy should be verified from the top down. First identify the PDC Emulator in the forest root domain and confirm that it is using the intended external source. Then check the other domain controllers and a selection of member computers to confirm that they are using domain-based sources.
A member computer does not need to report the forest root PDC Emulator directly. Reporting a local domain controller is expected. Similarly, a domain controller may report another domain controller rather than the PDC Emulator itself, provided that the resulting chain follows the domain hierarchy.
The commands used to identify role holders, display current sources and examine Windows Time Service configuration are covered in Verifying the Windows Time configuration.