W32Time Logs Event ID 36 Message on Windows Server 2003 RC1-Based Domain Controllers and Designated Time Servers

W32Time reports itself as "unsynchronized," and it stops serving time to requesting clients. In response to the unsynchronized status, an event ID 36 message is logged in the system event log: Even though W32Time runs on all Windows Server 2003-based computers, the resolution of this event is primarily for Windows Server 2003-based domain controllers.

This problem occurs because there is a code bug in the Release Candidate 1 (RC1) release of Windows Server 2003. The problem is aggravated by network congestion, a high CPU load or a high network load, and synchronization from low accuracy time sources.

The problem has been resolved in post-RC1 builds of Windows Server 2003.

To work around this problem, configure the following registry settings to any Windows Server 2003 RC1-based time server or domain controller to prevent that particular computer from experiencing the problem:

1. Start Registry Editor.
2. Locate and then click the following registry keys, and then add the following registry values:
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32time\Config\
     
     
     Value name:
     MinPollInterval
     
     Value type: Reg_DWord
     Value data: 6
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32time\Config\
     
     
     Value name:
     MaxPollInterval
     
     Value type: Reg_DWord
     Value data: 14
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32time\Parameters\
     
     
     Value name:
     NtpServer
     
     Value type: Reg_SZ
     Value data: Root time server that you are using,0x1
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32time\Parameters\
     
     
     Value name:
     Type
     
     Value type: Reg_SZ
     Value data: NTP
   • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32time\TimeProviders\NtpClient\
     
     
     Value name:
     SpecialPollInterval
     
     Value type: Reg_DWord
     Value data: 300
     
     If the "root time server that you are using,0x1" syntax for the
     NtpServer
     registry value is confusing, use the primary domain controller (PDC) of the forest root domain root as the root time service.
   Microsoft recommends that you apply the registry settings to all Windows Server 2003 RC1-based servers that are hosting the time service.. Note that computers that use this configuration will be using unauthenticated time.
3. Restart the time service. To do so, type the following command from the NT CMD prompt:
   c:\>net stop w32time & net start w32time

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

By design, W32Time reports itself as "unsynchronized" when it has not received a valid time sample in 1.5 times the maximum poll interval. This threshold was appropriate when the maximum poll interval on domain controllers was set to higher defaults (2^15 seconds). However, now that the maximum poll interval has been reduced to 2^10 seconds, the following problem occurs:

1. W32Time synchronizes as expected, and it reaches the maximum poll interval.
2. W32Time experiences one synchronization error (either because of a loss of network connectivity, or the server is down), and then it sets itself to "unsynchronized."

Typically, W32time does not set its time to "unsynchronized" unless it has failed several polls.