A Windows clock can be wrong in several ways: a few seconds off, exactly one hour off, or a VM that drifts by a few minutes until Kerberos stops working. The tool for all of these is the same: the Windows Time service (w32time) and its command-line companion w32tm. This post collects how it works, how to find out what it is actually doing, and how to fix it, including the case where the time source is not Windows at all but a Linux server running chrony.
This is a general guide. Signed time from a Samba AD DC (MS-SNTP), and why Windows clients may silently refuse it, has its own article; here it only comes up briefly.
The short version
- Find out where the time comes from:
w32tm /query /sourceandw32tm /query /status. If it says Local CMOS Clock or Free-running System Clock, the machine is not synchronising from the network at all. - Measure before you change anything:
w32tm /stripchart /computer:ntp.example.com /dataonly /samples:5shows the offset to a server without touching the clock. - Standalone / workgroup machine:
w32tm /config /manualpeerlist:"ntp.example.com,0x8" /syncfromflags:manual /update, thenw32tm /resync. Use the0x8flag (client mode), especially with Unix NTP servers. - Domain member: don’t configure a manual server.
w32tm /config /syncfromflags:domhier /updateputs it back on the domain hierarchy. - Domain: only the PDC emulator of the forest root domain gets an external source (and
/reliable:yes). Everything else follows the hierarchy. - Linux as the source: chrony needs an
allowline, UDP 123 open, and it must be synchronised itself. An unsynchronised server is useless to Windows. - Exactly one hour off? That’s almost always the time zone (or a dual-boot RTC setting), not NTP.
How Windows keeps time
The Windows Time service implements NTP with two built-in providers (How the Windows Time Service Works):
- NtpClient (input provider): fetches time samples from configured sources. Enabled everywhere by default.
- NtpServer (output provider): answers NTP requests from other machines. Off by default on clients and member servers, on for domain controllers.
Both use UDP port 123. Which sources the client uses is decided by the registry value Type under HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters:
| Type | Time comes from | Typical for | Set with |
|---|---|---|---|
NT5DS | The Active Directory domain hierarchy | Domain members and DCs (default) | /syncfromflags:domhier |
NTP | The servers in the NtpServer value | Workgroup machines (default), the forest root PDC emulator | /syncfromflags:manual |
AllSync | Domain hierarchy, falls back to NtpServer | Domain laptops that are often off-network | /syncfromflags:domhier,manual |
NoSync | Nothing, the local clock is trusted | Isolated setups, special cases | Registry or GPO |
In a domain
Domain members (clients and member servers) synchronise with a domain controller of their own domain. Domain controllers synchronise with the PDC emulator of their domain or with a DC in the parent domain. At the top sits the PDC emulator of the forest root domain, which is the only machine that should talk to an external time source. Packets inside the domain are signed with the machine’s Kerberos/Netlogon session key, so a domain member only accepts time from a DC it can authenticate.
The reason all of this matters is Kerberos: the default maximum tolerance for computer clock synchronization is 5 minutes. A client whose clock differs from the DC by more than that can no longer log on, access shares or print. That is also why Microsoft warns against pointing individual domain members at some other NTP server: if they drift apart from the DCs, authentication breaks.
Standalone and workgroup machines
Machines that are not domain members use Type=NTP and, out of the box, time.windows.com. With the 0x1 flag on the server entry they don’t use the adaptive NTP poll interval but a fixed SpecialPollInterval. The documented default for that is 604,800 seconds (one week), but since Windows 10 1703 it is clamped by MaxPollInterval (215 = 32,768 seconds, roughly 9 hours). Either way: a standalone Windows machine checks the time rarely, and a bad clock can drift for hours before anything happens.
Defaults that explain a lot
A few values from the W32Time registry reference (all under W32Time\Config) explain most of the “why doesn’t it just fix the clock” questions:
| Setting | Standalone | Domain member | Domain controller |
|---|---|---|---|
MaxPosPhaseCorrection / MaxNegPhaseCorrection | 54,000 s (15 h) | 0xFFFFFFFF (always correct) | 172,800 s (48 h) |
MinPollInterval / MaxPollInterval (log2 s) | 10 / 15 (1024 s / 32768 s) | 10 / 15 | 6 / 10 (64 s / 1024 s) |
MaxAllowedPhaseOffset | 1 s | 300 s | 300 s |
The first line is the important one: if a standalone machine is more than 15 hours off, w32time refuses to correct it and only logs an event. Offsets below MaxAllowedPhaseOffset are corrected gradually by slewing the clock rate; larger ones are stepped immediately.
Diagnosis: what is w32time doing?
All commands below need an elevated prompt (cmd or PowerShell, “Run as administrator”).
Source and status
C:\> w32tm /query /source
ntp.example.com,0x8
C:\> w32tm /query /status
Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -23 (119.209ns per tick)
Root Delay: 0.0148120s
Root Dispersion: 0.0327411s
ReferenceId: 0xC0A80A05 (source IP: 192.168.10.5)
Last Successful Sync Time: 10/24/2026 10:14:03 AM
Source: ntp.example.com,0x8
Poll Interval: 10 (1024s)That is example output from a healthy client. The interesting fields are Source, Last Successful Sync Time and Stratum. Typical signs of trouble:
- Source: Local CMOS Clock: the service has no usable network source and runs on the hardware clock. On a forest root PDC emulator this means nobody configured an external source.
- Source: Free-running System Clock: the service has no (current) source and the clock just runs on. You see this e.g. right after a service restart or when all sources have been unreachable for a while.
- Source: VM IC Time Synchronization Provider: the VM takes its time from the Hyper-V host (see the VM section below).
- Last Successful Sync Time: unspecified or days ago: the configured source never answered usefully.
Configuration and peers
Example output (shortened):
C:\> w32tm /query /configuration
...
NtpClient (Local)
DllName: C:\WINDOWS\system32\w32time.dll (Local)
Enabled: 1 (Local)
...
NtpServer: ntp.example.com,0x8 (Local)
Type: NTP (Local)
...
C:\> w32tm /query /peers
#Peers: 1
Peer: ntp.example.com,0x8
State: Active
Time Remaining: 912.4013126s
Mode: 3 (Client)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 10 (1024s)
HostPoll Interval: 10 (1024s)In the configuration output, the suffix after each value tells you where it comes from: (Local) is the registry, (Policy) means a GPO sets it, and then changing it with w32tm /config is pointless because the policy wins. In the peers output, check State (Active is good, Pending means no valid answer yet) and Mode (3 = client, 1 = symmetric active).
Measuring the offset with stripchart
w32tm /stripchart sends NTP requests from an ephemeral port and only prints the offset. It does not change the clock, and it works even when the service is misconfigured, so it’s the first thing I run against a candidate server (example output):
C:\> w32tm /stripchart /computer:ntp.example.com /dataonly /samples:5
Tracking ntp.example.com [192.168.10.5:123].
Collecting 5 samples.
The current time is 10/24/2026 10:21:07 AM.
10:21:07, -00.0021407s
10:21:09, -00.0020985s
10:21:11, -00.0021733s
10:21:13, -00.0021052s
10:21:15, -00.0021399sIf you get error: 0x800705B4 (timeout) for every sample, the server doesn’t answer: wrong name, firewall, or the server doesn’t allow your network. If you get sensible offsets here but the service still won’t sync, the problem is in the w32time configuration, not the network.
Forcing a sync
C:\> w32tm /resync
Sending resync command to local computer
The command completed successfully.
C:\> w32tm /resync /rediscover/rediscover re-detects the network configuration and the sources first. Useful after changing the configuration or after a laptop moved networks. If the service isn’t running you get The service has not been started: start it with net start w32time. On Windows 11 the “Sync now” button under Settings → Time & language → Date & time does the same thing.
The event log
w32time logs to the System log (source Microsoft-Windows-Time-Service) and, on current versions, to Applications and Services Logs → Microsoft → Windows → Time-Service → Operational. Events I find useful:
| Event ID | Log | Meaning |
|---|---|---|
| 36 | System | The service hasn’t synchronised for a long time and can’t provide time to clients |
| 129 | System | NtpClient couldn’t find a domain peer (DC discovery error) |
| 134 | System | NtpClient couldn’t use a manual peer because of a DNS resolution error |
| 142 | System | The service stopped advertising as a time source because the local clock isn’t synchronised (typical on a DC) |
| 1 (Kernel-General) | System | The system time was changed, including by which process, useful to catch unexpected jumps |
| 257, 260, 263 | Time-Service/Operational | Service start and configuration dumps, including the active settings |
A quick way to see the recent ones in PowerShell:
PS C:\> Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Time-Service'} -MaxEvents 20 |
Format-Table TimeCreated, Id, Message -WrapThe debug log
When the event log isn’t enough, w32time has a detailed private log:
C:\> w32tm /debug /enable /file:C:\Temp\w32time.log /size:10000000 /entries:0-300
C:\> w32tm /resync /rediscover
... reproduce the problem, read the log ...
C:\> w32tm /debug /disableIt is verbose, but it shows every sample received, every rejected sample and the configuration as read by the service (lines starting with ReadConfig:). Don’t forget to disable it again.
Fixes
Standalone machines: point them at a good server
C:\> w32tm /config /manualpeerlist:"ntp1.example.com,0x8 ntp2.example.com,0x8 ntp3.example.com,0x8" /syncfromflags:manual /reliable:no /update
The command completed successfully.
C:\> w32tm /resync /rediscover
C:\> w32tm /query /statusDetails that matter:
- Multiple servers are separated by spaces, so the list needs quotes.
/updatetells the running service to re-read its configuration. Without it, nothing changes until the next restart.- Microsoft recommends three or more servers. With only two, mark one as fallback with
0x2, e.g."ntp1.example.com,0x8 ntp2.example.com,0xa".
The flags after the comma are a bit mask:
| Flag | Name | Effect |
|---|---|---|
0x1 | SpecialInterval | Poll at the fixed SpecialPollInterval instead of the adaptive NTP interval |
0x2 | UseAsFallbackOnly | Only use this server if the others fail |
0x4 | SymmetricActive | Send requests in symmetric active mode (NTP mode 1) |
0x8 | Client | Send requests in client mode (NTP mode 3) |
Flags combine: 0x9 is client mode with the special poll interval, 0xa client mode as fallback.
Why 0x8 matters with Unix servers: if neither 0x4 nor 0x8 is set, w32time picks the mode itself, and according to Microsoft’s KB 875424 it uses symmetric active mode whenever its own NtpServer provider is enabled, which is the case on every domain controller. Symmetric active is a peer-to-peer mode meant for servers backing each other up. Many Unix NTP servers only answer client-mode requests from unauthenticated hosts, so a DC asking in symmetric active mode simply gets no answer. 0x8 forces plain client mode, which every NTP server understands. There is no downside to setting it, so I always do.
Domain members: back to the hierarchy
A domain member that someone “fixed” with a manual server is a classic. Put it back on the domain hierarchy (example output):
C:\> w32tm /config /syncfromflags:domhier /update
C:\> net stop w32time && net start w32time
C:\> w32tm /resync /rediscover
C:\> w32tm /query /source
dc1.example.comThe source should now be one of your DCs. If it still shows a manual server, check w32tm /query /configuration for (Policy) values: a GPO is overriding you.
If your DCs are Samba AD DCs and the client keeps falling back to Local CMOS Clock, check the functional level: at 2012 or higher, Windows clients use the MS-SNTP extended authenticator, which current Samba and chrony can’t sign (Samba bug 14757). The symptom is 120-byte NTP requests from the client that never get a reply. Details and a fix are in my article on Samba AD, chrony and signed NTP.
The PDC emulator: the one machine with an external source
First find out which DC holds the role in the forest root domain (example output):
C:\> netdom query fsmo
...
PDC dc1.example.com
...
PS C:\> (Get-ADDomain (Get-ADForest).RootDomain).PDCEmulator
dc1.example.comOn that DC:
C:\> w32tm /config /manualpeerlist:"ntp1.example.com,0x8 ntp2.example.com,0x8 ntp3.example.com,0x8" /syncfromflags:manual /reliable:yes /update
C:\> w32tm /resync /rediscover
C:\> w32tm /query /status/reliable:yes marks the DC as a reliable time source, so the other DCs prefer it. When the PDC role moves to another DC, configure the new holder the same way and put the old one back on the hierarchy with w32tm /config /syncfromflags:domhier /reliable:no /update. Forgetting the second half gives you two “reliable” roots. To check the whole domain at once, w32tm /monitor lists all DCs with their offsets to the PDC.
Microsoft’s authoritative time server article also recommends lowering MaxPosPhaseCorrection/MaxNegPhaseCorrection on the PDC (e.g. to 3600 s), so a broken upstream server can’t drag the whole forest days into the past or future.
Group Policy
The same settings are available under Computer Configuration → Administrative Templates → System → Windows Time Service:
- Time Providers → Configure Windows NTP Client:
NtpServer,Type,SpecialPollIntervaland friends. - Time Providers → Enable Windows NTP Client / Enable Windows NTP Server: switch the providers on or off.
- Global Configuration Settings: the
Configvalues such as phase correction limits andUtilizeSslTimeData.
Two traps: once you enable a policy, all of its fields are applied, and the policy defaults are not always the registry defaults (the docs list e.g. SpecialPollInterval 1024 and NtpServer time.windows.com,0x9 as policy defaults). And a PDC-emulator GPO linked to the Domain Controllers OU hits all DCs. If you use a GPO for the PDC, filter it with a WMI filter on the PDC role, or just configure the PDC with w32tm.
Last resort: reset w32time
If the configuration is beyond repair, unregistering and registering the service restores the defaults for the machine’s role:
C:\> net stop w32time
C:\> w32tm /unregister
C:\> w32tm /register
C:\> net start w32time
C:\> w32tm /resync /rediscoverSometimes /unregister complains that the service is still marked for deletion; a reboot between the two steps helps. Afterwards, re-apply your own configuration (and on the PDC emulator: definitely re-apply it).
A Linux NTP server as the time source
Windows doesn’t care what is on the other end of UDP 123. A Linux box running chrony makes an excellent time source for standalone Windows machines and for the forest root PDC emulator. (Domain members should still use the DCs, see above.)
chrony
By default chronyd is only a client: “no clients are allowed access” (chrony.conf). To serve your network, add allow lines to /etc/chrony/chrony.conf (Debian/Ubuntu) or /etc/chrony.conf (RHEL and friends):
# upstream sources
pool 2.debian.pool.ntp.org iburst
# serve these networks
allow 192.168.10.0/24
allow 10.20.0.0/16
# optional: only listen on one address
#bindaddress 192.168.10.5
# optional: keep serving if upstream is gone, see below
#local stratum 10 activate 0.5$ sudo systemctl restart chrony # "chronyd" on RHEL
$ sudo firewall-cmd --permanent --add-service=ntp && sudo firewall-cmd --reload
# or with ufw:
$ sudo ufw allow from 192.168.10.0/24 to any port 123 proto udpbindaddress restricts the listening socket; chrony accepts only one per address family. allow without a subnet allows everybody, which you rarely want.
The server must be synchronised itself
This is the part that bites. An NTP server that has no valid upstream sends its answers with the leap indicator set to “not synchronised”. Windows (correctly) doesn’t use such samples, so w32tm /stripchart may happily show offsets while w32tm /resync reports no time data was available. Check the server first (example output):
$ chronyc tracking
Reference ID : 4F8D0C16 (ntp1.example.net)
Stratum : 3
Ref time (UTC) : Sat Oct 24 08:20:51 2026
System time : 0.000012853 seconds fast of NTP time
Last offset : +0.000008120 seconds
RMS offset : 0.000021457 seconds
Frequency : 4.123 ppm slow
Residual freq : +0.001 ppm
Skew : 0.045 ppm
Root delay : 0.012345678 seconds
Root dispersion : 0.000456789 seconds
Update interval : 1029.4 seconds
Leap status : NormalLeap status: Normal and a real reference ID are what you want. Reference ID 00000000, Stratum 0 and Leap status: Not synchronised mean the server has no source, and every Windows client behind it will fail. chronyc sources -v shows why (unreachable pool, blocked outbound UDP 123, DNS).
The local directive makes chronyd appear synchronised to clients even when it isn’t, “even when it was never synchronised or the last update of the clock happened a long time ago”, as the man page puts it. That’s intended for isolated networks where machines only need to agree with each other. On a normal network it hides upstream failures: the Windows clients stay happy while everybody drifts away from real time together. If you use it, use activate (the local reference only becomes usable after the server was properly synchronised once), keep the stratum high (the default 10 is fine), and monitor the upstream sync separately.
Checking that Windows is actually being served
On the chrony server, chronyc clients lists the hosts that have asked for time (example output):
$ sudo chronyc clients
Hostname NTP Drop Int IntL Last Cmd Drop Int Last
===============================================================================
win11-01.example.com 14 0 10 - 311 0 0 - -
dc1.example.com 212 0 6 - 41 0 0 - -Each Windows machine should show up with a growing NTP counter and an Int (log2 poll interval) that matches what w32tm /query /status shows on the Windows side. If a machine is missing here, its requests don’t arrive: firewall or wrong server name. If it’s listed with a high Drop count, chrony’s rate limiting kicked in (only if you configured ratelimit).
ntpd / NTPsec
With the classic ntpd or NTPsec, access is controlled with restrict lines in ntp.conf:
restrict default kod limited nomodify nopeer noquery
restrict -6 default kod limited nomodify nopeer noquery
restrict 127.0.0.1
restrict ::1
restrict 192.168.10.0 mask 255.255.255.0 nomodify nopeer noquerynopeer is exactly why the 0x8 flag matters: ntpd is not supposed to answer unauthenticated symmetric active requests. ntpd has a long-standing workaround that answers them anyway, but Meinberg documents that a 2018 change broke it until 4.2.8p12. Client mode avoids the whole question.
What Windows can’t do
- NTS: chrony and NTPsec support Network Time Security, but w32time doesn’t, as far as I can tell from the current documentation. Time from a manually configured server is unauthenticated plain NTP.
- Signed domain time: domain members expect MS-SNTP responses signed with their machine account key. A plain chrony server can’t do that; with a Samba AD DC, chrony or ntpd can sign them via Samba’s
ntp_signdsocket (ntpsigndsocketin chrony). That works for the classic MS-SNTP format, but not for the extended authenticator that Windows uses against DCs at functional level 2012 or higher; see my article on Samba AD, chrony and signed NTP.
Pitfalls
Exactly one (or two) hours off: the time zone
NTP only transports UTC. If the clock is off by whole hours, NTP is working fine and the time zone is wrong (example output):
C:\> tzutil /g
UTC
C:\> tzutil /l | findstr /i "Berlin"
(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna
C:\> tzutil /s "W. Europe Standard Time"PowerShell has Get-TimeZone and Set-TimeZone -Id "W. Europe Standard Time" for the same job. One surprise: .NET caches the local time zone per process. After changing it, Get-Date in the same PowerShell window still shows the old local time. Open a new window, call [System.TimeZoneInfo]::ClearCachedData(), or compare in UTC with [DateTime]::UtcNow, which isn’t affected.
The other whole-hour classic is dual boot: Windows by default keeps the hardware clock in local time, Linux in UTC. Each OS “corrects” the other after a reboot. The usual fix is on the Linux side (timedatectl set-local-rtc 1), or the other way round by telling Windows that the RTC is UTC (the RealTimeIsUniversal registry value, which is widely used but not something Microsoft documents prominently).
Virtual machines: two clocks fighting
Hypervisors bring their own time sync. On Hyper-V, the guest’s w32time gets a VMICTimeProvider that takes time from the host, visible as VM IC Time Synchronization Provider in w32tm /query /source. For ordinary VMs that’s fine as long as the host has good time. For domain controllers, especially the PDC emulator, you don’t want the host to override the domain hierarchy. Microsoft’s guidance has changed over the years; the common approach today is to disable the time sync integration service for DC VMs on the host:
PS C:\> Get-VMIntegrationService -VMName DC1 -Name "Time Synchronization"
PS C:\> Disable-VMIntegrationService -VMName DC1 -Name "Time Synchronization"The older alternative is to disable only the provider inside the guest (Enabled=0 under HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider, then restart w32time), so the host only sets the time when the VM resumes from a saved state.
On VMware, VMware Tools can sync the guest periodically. Check and switch it off in the guest if w32time (or the domain) should be in charge (example output):
C:\> "C:\Program Files\VMware\VMware Tools\VMwareToolboxCmd.exe" timesync status
Enabled
C:\> "C:\Program Files\VMware\VMware Tools\VMwareToolboxCmd.exe" timesync disable
DisabledThat only disables the periodic sync. VMware Tools still sets the guest clock on certain events (e.g. resume, snapshot restore, Tools startup); those are controlled by time.synchronize.* options in the VM’s .vmx configuration. Whatever you choose: exactly one mechanism should be steering the clock.
Secure Time Seeding: sudden jumps by days or years
Since Windows 10 1511, w32time has Secure Time Seeding (STS): it estimates the time from metadata in outgoing TLS connections and uses it to correct grossly wrong clocks. The idea is good for a laptop with a dead CMOS battery. On servers, it has caused trouble: Microsoft’s STS recommendations for Windows Server describe customer reports where w32time set the clock to “a random incorrect value, with a time error varying from days and weeks to years”. Microsoft now recommends disabling STS on Windows Server 2016 to 2022 machines with time-sensitive workloads (explicitly including domain controllers and VM hosts), and it is off by default in Windows Server 2025. For Windows client editions there is no general recommendation to disable it.
Checking and disabling it (example output):
C:\> reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config /v UtilizeSslTimeData
UtilizeSslTimeData REG_DWORD 0x1
C:\> reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config /v UtilizeSslTimeData /t REG_DWORD /d 0 /fThe change requires a reboot. The GPO equivalent is UtilizeSslTimeData in Global Configuration Settings. If you see unexplained jumps, the Kernel-General event 1 in the System log tells you which process set the time.
Large offsets
If the clock is too far off, w32time won’t fix it on its own: on standalone machines the limit is 15 hours, on DCs 48 hours (MaxPos/NegPhaseCorrection, see above). A domain member more than 5 minutes off from its DC also runs into the Kerberos limit described above. In both cases, set the clock roughly by hand first (Settings, or Set-Date in PowerShell), then run w32tm /resync. Don’t raise the limits to 0xFFFFFFFF on a PDC emulator; that’s the machine where a bad upstream sample would do the most damage.
Laptops, sleep and a service that isn’t running
On many workgroup installations w32time isn’t running permanently: it’s set to Manual (Trigger Start) and woken up by a scheduled task (\Microsoft\Windows\Time Synchronization\SynchronizeTime) or a trigger. Combined with the long poll interval, a laptop that is mostly asleep may rarely sync at all. Check with sc qc w32time and sc qtriggerinfo w32time. If the machine needs reliable time, set the service to start automatically (sc config w32time start= auto, note the space after =), which is also what Microsoft’s high-accuracy guide asks for. Domain laptops that are often off the corporate network are a candidate for AllSync (/syncfromflags:domhier,manual plus a manual peer list).
“No time data was available”
C:\> w32tm /resync /rediscover
Sending resync command to local computer
The computer did not resync because no time data was available.This is the generic “I asked and got nothing usable” error. According to Microsoft, the usual causes are:
- Name resolution: the server name is wrong or doesn’t resolve (event 134 for manual peers, 129 for domain peers).
- UDP 123 blocked: locally or on a firewall in between. A packet capture during
w32tm /resynctells you which. - The server doesn’t serve: a DC that isn’t advertising as a time server (check
dcdiag /test:Advertisingandw32tm /monitor), or, from my list above, a Unix server that ignores symmetric active requests (use0x8) or isn’t synchronised itself.
Troubleshooting checklist
- Is it the time zone? Whole-hour offset →
tzutil /g, compare in UTC, check dual boot. - Is the service running?
sc query w32time,sc qc w32time. - Where does the time come from?
w32tm /query /sourceand/status: CMOS clock, free-running, VM IC provider, or a real server? - Is the configuration what you think?
w32tm /query /configuration:Type,NtpServer, and any(Policy)values. - Does the server answer?
w32tm /stripchart /computer:SERVER /dataonly /samples:5. - Is the server synchronised? On Linux:
chronyc trackingshows Leap status: Normal; on Windows:w32tm /query /statuson the server. - Right mode? Manual peers with
,0x8;w32tm /query /peersshows Mode: 3 (Client). - Domain member? Back to
/syncfromflags:domhier. Only the forest root PDC emulator gets an external source and/reliable:yes. With a Samba AD DC at functional level 2012 or higher and 120-byte requests without a reply, see the Samba article. - VM? Exactly one time sync mechanism: hypervisor or w32time, and not the hypervisor for DCs.
- Too far off? Set the time roughly by hand, then
w32tm /resync. - Unexplained jumps? Kernel-General event 1 for the culprit, consider disabling STS on servers.
- Still unclear? Event log (System and Time-Service/Operational), then the debug log with
w32tm /debug /enable. - Nothing helps?
w32tm /unregister+/registerand configure from scratch.
Often step 5 already shows the problem: the source is the CMOS clock or a server that doesn’t answer, and a correct /manualpeerlist with 0x8, or /syncfromflags:domhier on a domain member, fixes it.