Elusive Windows Time Synchronisation

[Guest]

[ocky]

Have read some posts on this, but I still can't get windows time to synchronise. Connection details as follows:-
1.  svchost.exe - Source = UDP out 0.0.0.0:68; Destination = 255.255.255.25 (684 bytes)
2.  svchost.exe - Source = UDP out 192.168.x.x Port 123; Destination = 207.46.232.182 Port 123
     (90 bytes)
3. Nothing incoming at all !?

The only svchost.exe entry in App.Mon. I have is: Path: C:\Program Files\ Internet Explorer\iexplore.exe with Parent Path: C:\WINDOWS\system32\svchost.exe (Allow)


There were no prompts to allow deny for the time synchronisation. Do I need to make a rule in App. Mon specifically for svchost.exe with no restrictions at all ?

Always confused.   

[ocky]

Have read some posts on this, but I still can't get windows time to synchronise. Connection details as follows:-

These rules in App. Mon don't do it. See attachment. (Have rebooted after creating the rules)

[gibran]

Experimenting with appmon is a waste of ntp time

To find your answer maybe you should watch the log. I'm pretty sure that ntp requre only an outbound connection so it should work with the standard ruleset.

Use the update now button in the internet time tab  and look for blocked packets in the log...

[ocky]

Experimenting with appmon is a waste of ntp time

To find your answer maybe you should watch the log. I'm pretty sure that ntp requre only an outbound connection so it should work with the standard ruleset.

Use the update now button in the internet time tab  and look for blocked packets in the log...

No nothing is blocked, simply no inbound. According to the first post in this thread, incoming UDP needs to be allowed for 123....http://forums.comodo.com/index.php?PHPSESSID=06a87c7de6f057bebdc4e954f3bb91e2&topic=6297.msg47149#msg47149

Then CPF Application Monitor that is in my knowledge not
 implementing any SPI bookkeeping comes to play.
There needs to be a rule allowing svchost.exe allow incoming
UDP for local port 123 to your computer IP (or your PC's hostname).

Also there is no entry in Component Mon. for svchost.exe. Should there be ?
Maybe I should just disable Windows time in services, as I can do a time synchro. with other apps.  that I have installed. On the other hand it would be better if everything is working as it should.   

[Soyabeaner]

Do I need to make a rule in App. Mon specifically for svchost.exe with no restrictions at all ?

If you have the default option enabled: do not show any alerts by the ceritified database ... (it's too long to type out) then you don't need an AppMon rule.

there is no entry in Component Mon. for svchost.exe. Should there be ?

I don't know why it shouldn't, but it's not on my CM list either.

Maybe I should just disable Windows time in services, as I can do a time synchro. with other apps.

Maybe you should to save yourself some ram .  I certainly have it disabled.  Seriously, what you can do as a test is set the security level to Allow All and then see if it works.  If it does then we know it's a rules problem.

[gibran]

Interesting thread indeeed! but like reported there you don't need to enable a udp incomig rule

This time you could use that rule to enable logging on that port.

regarding component monitor if it is in learn mode you don't need to do anyting.
But check for w32time.dll in the component monitor to see if it is blocked.

change the default time server in the internet time tab, use the ones which work in the other net time apps.

Sometimes the win32time service complain about a rpc error is this the case?

[ocky]

If you have the default option enabled: do not show any alerts by the ceritified database ... (it's too long to type out) then you don't need an AppMon rule.

Thanks Soya. Yes I have always had it enabled. Please see my last post, maybe things have changed and the app. mon. rules are not required. However with or without it's still no go for me. (My Netmon rules are default). Should I do a scan for known apps. again ?

[Soyabeaner]

Yes I have always had it enabled. Please see my last post, maybe things have changed and the app. mon. rules are not required. However with or without it's still no go for me. (My Netmon rules are default). Should I do a scan for known apps. again ?

When that certified app option is enabled it basically bypasses AppMon and goes directly to NetMon (unless you have an AppMon rule blocking svchost.exe, as it would take first precedence).  Scan for known apps shouldn't be needed, but it won't hurt to try.  Finally, a reboot may be needed on some systems.

[ocky]

Time service is allowed in Comp. Mon. (w32time.dll). Setting Comodo to Allow All I still can't connect. Maybe the server is down. Do you think it may have something to do with Proxomitron ?
I doubt it.

[gibran]

Well if other timesync apps work maybe overriding w32time server with a custom one can do the job.
Use time servers of other timesync apps.

It does not harm deleting svchost rules in appmon...

[ocky]

Well if other timesync apps work maybe overriding w32time server with a custom one can do the job.
Use time servers of other timesync apps.
It does not harm deleting svchost rules in appmon...

Yeah, will do as nothing seems to work. Even this run command is no good in my case:
w32tm /resync /rediscover.
I will use Query App. - see attachment. It works well.

[ocky]

Interesting thread indeeed!

change the default time server in the internet time tab, use the ones which work in the other net time apps.

Thank you, I have changed the time server to time-a.nist.gov. No problems it works. I just wonder why the default one doesn't.   

EDIT:   I suppose I can disable Windows time service now ?

[gibran]

 
well I was starting to be clueless.

Also I noticed I'm not able to log inbound udp:123 with an allow rule
I'll try the next reboot..

[Jarmo P]

With these svchost.exe rules my time synchro works.
As you see, incoming is also needed for solicited connections to udp 123.
No ports need to be opened in network monitor though.
You may  need to reboot before rules begin to work properly.

EDIT
It is not working now.

[ocky]

gov = government.  They want to keep tabs on you

Microsoft or gov. Your recommendations ?   
Jarmo P has the settings that I tried earlier (except IP address diference), but even after reboot no luck here. Maybe Proxomitron after all.

[Tags:]