How to configure an authoritative time server in Windows Server

Applies to: Windows Server 2012 StandardWindows Server 2012 EssentialsWindows Server 2008 R2 Standard

This article decribes how to configure the Windows Time service and troubleshoot when the Windows Time service doesn't work correctly.

Configuring the Windows Time service to use an external time source


To configure an internal time server to synchronize with an external time source, use one of the following methods:

Automatically configure the Windows Time service

To fix this problem automatically, click the Download button. In the File Download dialog box, select Run or Open, and then follow the steps in the easy fix wizard.

  • When you run the easy fix solution to configure an external time source you will need to specify the name of your NTP server. The easy fix solution will have the placeholder names of Server1 and Server2. Replace these placeholder names with the name of your NTP server followed by “,0x1”. i.e SRV1.Contoso.com,0x1. You do not have to specify more than one server but it is recommended to do so for redundancy. If you have multiple entries they must be separated by a space.
  • The unit of time for SpecialPollInterval,MaxPosPhaseCorrectionand MaxNegPhaseCorrection settings is in seconds.
  • This wizard may be in English only. However, the automatic fix also works for other language versions of Windows.
  • If you’re not on the computer that has the problem, save the easy fix solution to a flash drive or a CD, and then run it on the computer that has the problem.

Manually configure an authoritative time source on the forest root PDC of an AD forest

To configure the PDC in the root of an Active Directory forest to synchronize with an external time source, follow these steps:

  1. Change the server type to NTP. To do this, follow these steps:
    1. Select Start > Run, type regedit, and then select OK.
    2. Locate and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type
    3. In the pane on the right, right-click Type, and then select Modify.
    4. In Edit Value, type NTP in the Value data box, and then select OK.
  2. Set AnnounceFlags to 5. To do this, follow these steps:
    1. Locate and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags
    2. In the pane on the right, right-click AnnounceFlags, and then select Modify.
    3. In Edit DWORD Value, type 5 in the Value data box, and then select OK.
  1. Enable NTPServer. To do this, follow these steps:
    1. Locate and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer
    2. In the pane on the right, right-click Enabled, and then select Modify.
    3. In Edit DWORD Value, type 1 in the Value data box, and then select OK.
    4. Specify the time sources. To do this, follow these steps:
      1. Locate and then click the following registry subkey:
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
      2. In the pane on the right, right-click NtpServer, and then select Modify.
      3. In Edit Value, type Peers in the Value data box, and then select OK.
         
  2. Configure the time correction settings. To do this, follow these steps:
    1. Locate and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\MaxPosPhaseCorrection
    2. In the pane on the right, right-click MaxPosPhaseCorrection, and then select Modify.
    3. In Edit DWORD Value, click to select Decimal in the Base box.
    4. In Edit DWORD Value, type TimeInSeconds in the Value data box, and then select OK.

       
    5. Locate and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\MaxNegPhaseCorrection
       
    6. In the pane on the right, right-click MaxNegPhaseCorrection, and then select Modify.
    7. In Edit DWORD Value, click to select Decimal in the Base box.
    8. In Edit DWORD Value, type TimeInSeconds in the Value data box, and then select OK.
       
  3. Close Registry Editor.
  4. At the command prompt, type the following command to restart the Windows Time service, and then press Enter:
    net stop w32time && net start w32time

Time Servers available on the internet

For a list of available time servers, see Microsoft Knowledge Base article 262680: A list of the Simple Network Time Protocol (SNTP) time servers that are available on the Internet

Troubleshooting


For the Windows Time service to function correctly, the networking infrastructure must function correctly. The most common problems that affect the Windows Time service include the following:

  • There is a problem with TCP/IP connectivity, such as a dead gateway.
  • The Name Resolution service is not working correctly.
  • The network is experiencing high volume delays, especially when synchronization occurs over high-latency wide area network (WAN) links.
  • The Windows Time service is trying to synchronize with inaccurate time sources.

We recommend that you use the Netdiag.exe utility to troubleshoot network-related issues. Netdiag.exe is part of the Windows Server 2003 Support Tools package. See Tools Help for a complete list of command-line parameters that you can use with Netdiag.exe. If your problem is still not solved, you can turn on the Windows Time service debug log. Because the debug log can contain very detailed information, we recommend that you contact Microsoft Customer Support Services when you turn on the Windows Time service debug log.

For a complete list of Microsoft Customer Support Services telephone numbers and information about support costs, go to the Contact Microsoft website.

Information icon
 Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question. WAZOO.

More Information


Windows Server includes W32Time, the Time Service tool that is required by the Kerberos authentication protocol. The Windows Time service makes sure that all computers in an organization that are running the Microsoft Windows 2000 Server operating system or later versions use a common time. 

To guarantee appropriate common time usage, the Windows Time service uses a hierarchical relationship that controls authority, and the Windows Time service does not allow for loops. By default, Windows-based computers use the following hierarchy:

  • All client desktop computers nominate the authenticating domain controller as their in-bound time partner.
  • All member servers follow the same process that client desktop computers follow.
  • All domain controllers in a domain nominate the primary domain controller (PDC) operations master as their in-bound time partner.
  • All PDC operations masters follow the hierarchy of domains in the selection of their in-bound time partner.

In this hierarchy, the PDC operations master at the root of the forest becomes authoritative for the organization. We highly recommend that you configure the authoritative time server to obtain the time from a hardware source. When you configure the authoritative time server to sync with an Internet time source, there is no authentication. We also recommend that you reduce your time correction settings for your servers and stand-alone clients. These recommendations provide more accuracy and security to your domain.

References


For more information about Windows Time service, see the following Microsoft Knowledge Base articles:For more information about the Windows Time service, see this  Windows Time Service Technical Reference.