Tutorials

The domain controller that holds the PDC Emulator role is also the device that is the authoritative time source for any domain joined device on your network. Because time skew can cause major problems in a Windows network I always create a Group Policy that controls behavior of the time service on Windows Domain Controllers that hold the PDC Emulator role.

In this tutorial we create a Group Policy that will be responsible for the PDC Emulator in your network without you changing any setting if you move the PDC emulator role to another Domain Controller in the event you want migrate your DC to a newer Windows Server OS version or if you need to relocate the roles in a larger network with multiple domain controllers. I sometimes see administrators that put the DC that is the PDC Emulator in security filtering on a Group Policy. Imagine you move the PDC Emulator role from DC 1 to DC 2 but you forget to change security in the Group Policy it does not work anymore.

There is better way and that is to apply a WMI filter that filters specifically for DomainRole is 5. This would be something like this “Select * from Win32_ComputerSystem where DomainRole = 5”. So, instead of creating a solution that is guaranteed to break if you move the PDC Emulator we better make something that is future proof! Very handy when you migrate your DC!