Check Windows time against AD or target

On Windows servers, I believe the nsclient.ini is now renamed to NSC.ini on newer nagios XI agent installations. Change is under the "C:Program FilesNSClient++scripts" section and it should be; "-Add to NSC.ini" Also, if you haven't enabled or used NRPE checks, this is a good read with the main reminder to be that you need to restart your NSClient++ service after making changes to your NSC.ini file - https://assets.nagios.com/downloads/nagiosxi/docs/Enabling-The-NRPE-Listener-In-NSClient-0.3.x.pdf Lastly, if you're running the latest version of Nagios XI, where the instructions say to add a new command, I had to replace the -n with a -2 or else I would get version errors. ie. $USER1$/check_nrpe -H $HOSTADDRESS$ -2 -c check_time -a "$ARG1$" $ARG2$ $ARG3$

... but has it's shortcomings. This is a corrected version (hopefully it doesn't get garbled): # ==================================================================== # Check time against DC or specified server through NRPE / w32tm # Author: Mathieu Chateau - LOTP # mail: mathieu.chateau@lotp.fr # version 0.1 # corrected and fixes performance data for positive differences by UKA # ==================================================================== # # Require Set-ExecutionPolicy RemoteSigned.. or sign this script with your PKI # # ============================================================ # # Do not change anything behind that line! # param ( [string]$refTimeServer, [int]$maxWarn = 1, [int]$maxError = 5 ) $output="" $exitcode=2 $random= if(($refTimeServer -eq $null) -or ($refTimeServer -eq "") -or ($refTimeServer -eq " ")) { $refTimeServer=$env:LOGONSERVER -replace ('\',"") if(($refTimeServer -match "^$|^ $") -or ($env:LOGONSERVER -match $refTimeServer)) { if((gwmi win32_computersystem).partofdomain -eq $true) { #Must use select and not .Name directly. If some DC are down, command will be empty with .Name $fromAD=@() foreach ($entry in ((([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() | % { $_.DomainControllers }))| select Name)) { #if this server is a DC, can't check time against itself if(! (($env:COMPUTERNAME -match $entry) -or ($entry -match $env:COMPUTERNAME))) { $fromAD += $entry } } if($fromAD.Count -gt 1) { #get a random DC from AD, as no server provided and no logon server could be found $refTimeServer=(Get-Random -InputObject $fromAD).Name } else { #only one DC, defaulting to internet $refTimeServer="de.pool.ntp.org" } } else { #Workgroup but no server to check time against provided. Defaulting to internet to do something $refTimeServer="de.pool.ntp.org" } } } if(($refTimeServer -eq $null) -or ($refTimeServer -eq "") -or ($refTimeServer -eq " ")) { #Something bad happened. Should never happen Write-Host "CRITICAL: can't auto detect logon server to check against. Need to specify manually using refTimeServer argument" exit 2 } # determine time offset to selected server $temp=w32tm /stripchart /computer:$refTimeServer /period:1 /dataonly /samples:1 # get last line: time, [+-]00.00000 -> replace 00 by 0, replace +0 by + (for performance data) $temp=($temp | select -Last 1) -replace (".*, ","") -replace ("+0","0") -replace ("00.","0.") $temp=$temp -replace ("s$","") # default $state = "WARNING" if ($temp -match "^-?[0-9]+.[0-9]+$") { $output=$temp+"s - checked against "+$refTimeServer if ([math]::abs($temp) -gt $maxError) { $state="CRITICAL" $exitcode=2 } elseif ([math]::abs($temp) -gt $maxWarn) { $state="WARNING" $exitcode=1 } else { $state="OK" $exitcode=0 } } else { $output="Error: - used $refTimeServer as time server - output:$temp" $exitcode=2 } $output=$state+":"+$output+'|'+"offset="+$temp+"s"+";"+$maxWarn+";"+$maxError+";" Write-Host $output exit $exitcode