Hey Dan!

If you’re able to share the .reg file you’re working with, I’d be happy to translate it into complete PowerShell ( might make it easier to refer back to in the future, and deploying .reg files via PowerShell is a bit clunky ).

If you’d prefer not to share the .reg file - no problem at all; let me know in that case as well and I’ll frame up an example for deploying reg files.

Cheers!

- Anthony M.

I have seen this site referenced before: https://reg2ps.azurewebsites.net/

Here is the reg file (we are having some time drift issues with some offsite laptops and it is causing some issues with our DUO MFA on login.. This seems to resolve the issue as it forces a fallback to a non DC ntp source.

Windows Registry Editor Version 5.00

"NtpServer"="time.windows.com,0x9"
"Type"="AllSync"

"CrossSiteSyncFlags"=dword:00000002
"ResolvePeerBackoffMinutes"=dword:0000000f
"ResolvePeerBackoffMaxTimes"=dword:00000007
"SpecialPollInterval"=dword:00000400
"EventLogFlags"=dword:00000000
"Enabled"=dword:00000001

Alrighty, I’ve digested down the above registry values and you can find the respective evaluation and remediation code in the links below. If you have questions on implementing these scripts with a custom Worklet Policy please let me know and I can provide some additional guidance!

• Evaluation
• Remediation

Hope this helps!

- Anthony M.

This is great! much cleaner than what I came up with LOL

Works well, reboot after seems to kick it off. Helps with some awful time drift on our lenovo laptops while off network / traveling, etc… Never was an issue until we pushed out MFA on the device login :) 

Thanks!

Yeaaa, time drift in the context of device MFA can be a real pain. Glad this solved it; have a great day!

- Anthony M.