Windows Time Service should be checked from the top of the Active Directory hierarchy downwards. Begin with the PDC Emulator in the forest root domain, then check the other domain controllers, followed by a selection of member servers and workstations.

The source reported by each computer does not need to be identical. The forest root PDC Emulator should use an approved external source. Other domain controllers and domain members should normally obtain time from the Active Directory hierarchy.

What should each computer use?

The expected result depends on the role of the computer:

  • The forest root PDC Emulator should report one of the configured external NTP peers.
  • Other domain controllers should report a domain-based source.
  • Member servers and workstations should normally report a domain controller.
  • A standalone computer should report the manually configured NTP source or the source selected by its local Windows configuration.

A domain member is not expected to report the forest root PDC Emulator directly. Reporting a local domain controller is normal, provided that the resulting chain eventually leads to the authoritative source.

Check the current time source

Run the following command from an elevated Command Prompt:

w32tm /query /source

On the forest root PDC Emulator, the result should be one of the external peers configured for that server. On another domain controller or a domain member, the result should normally be the name of a domain controller.

The following sources usually require further investigation:

  • Local CMOS Clock
  • Free-running System Clock
  • VM IC Time Synchronization Provider on a virtual domain controller where host time synchronisation is not part of the intended design

Local CMOS Clock or Free-running System Clock indicates that Windows does not currently have a usable network time source. This may occur briefly during startup, but it should not remain the source on a correctly configured domain controller.

Review the synchronisation status

Display the current status with:

w32tm /query /status

The output includes several fields. The most useful during a routine check are:

Source
The source currently selected by Windows Time Service.
Stratum
The computer's position in the NTP hierarchy. A lower number is closer to the original reference clock. The value should be plausible for the design, but stratum alone does not prove that the source is correct.
Last Successful Sync Time
The last occasion on which Windows successfully synchronised. A recent value is expected on an active system.
Poll Interval
How frequently Windows is currently polling the selected source. The interval is displayed as a power-of-two value and its equivalent number of seconds.
Root Delay
The estimated round-trip delay between the computer and the reference source through the complete time path.
Root Dispersion
An estimate of the maximum accumulated error relative to the reference source.
Leap Indicator
The leap-second state reported by the source. A value of zero is normal. A value of three indicates that the server is not currently synchronised.

The status output is a snapshot. A recent successful sync and the correct source are generally more significant during a basic health check than small differences in delay or dispersion.

Display the effective configuration

Use the following command to display the Windows Time Service configuration:

w32tm /query /configuration

This output is useful because it identifies both the current values and the source from which many of those values were obtained. A setting may come from the local registry or from Group Policy.

On the forest root PDC Emulator, check that:

  • Type is set to NTP.
  • The NtpServer value contains the approved external peers.
  • The NTP client provider is enabled.

On other domain controllers and domain members, Type should normally be NT5DS, which instructs Windows to use the Active Directory domain hierarchy.

If a value is marked as being supplied by policy, changing the local registry or running w32tm /config may not produce a lasting result. The applicable Group Policy setting must be corrected instead.

Request a new synchronisation

To ask Windows Time Service to synchronise again, run:

w32tm /resync

Where the computer may have retained an outdated domain source, the rediscovery option can also be used:

w32tm /resync /rediscover

The message that the command completed successfully means the request was accepted. Check the source and status again to confirm that a successful synchronisation actually occurred.

If the command reports that no time data was available, common causes include an unreachable source, blocked UDP port 123, incorrect DNS resolution, an unsuitable peer mode or a source that is itself unsynchronised.

Test an NTP server directly

w32tm /stripchart can compare the local clock with another server without changing the computer's configuration:

w32tm /stripchart /computer:0.uk.pool.ntp.org /dataonly /samples:5

Replace the server name with the source being tested. The command displays a series of measurements showing the estimated offset between the local computer and the remote server.

A successful strip chart confirms that the computer can resolve the name and obtain time responses from the remote system. It does not prove that Windows Time Service has selected that server as its source. Use w32tm /query /source for that check.

The offset is shown in seconds. A positive or negative value indicates which clock is ahead; the important point during basic testing is whether responses are received consistently and whether the offset is reasonable.

Check another computer remotely

The source, status and configuration of another Windows computer can be queried remotely:

w32tm /query /computer:SERVER-NAME /source
w32tm /query /computer:SERVER-NAME /status
w32tm /query /computer:SERVER-NAME /configuration

Remote queries require suitable administrative permissions and access through the relevant Windows firewall and remote management controls. Where remote access is restricted, run the commands locally on the target computer instead.

Review the event logs

Windows Time Service records operational information in Event Viewer. The principal locations are:

  • Windows Logs > System, filtered for the Time-Service source.
  • Applications and Services Logs > Microsoft > Windows > Time-Service > Operational.

The logs can show source discovery, synchronisation changes, rejected time samples and failures to obtain usable time data. When investigating a problem, compare the event time with changes to Group Policy, firewall rules, DNS, virtualisation settings or FSMO roles.

Do not treat every informational event as a fault. Windows records routine changes as sources are discovered and selected. Warnings that repeat over an extended period, or events that coincide with an incorrect source, are more significant.

Allow time for the source to change

Windows Time Service does not always select a new source immediately after a configuration change. It may need to resolve the peer, collect samples and determine that the source is suitable before replacing the current source.

After changing the configuration, restart the Windows Time Service if appropriate, request a resynchronisation and then allow a short period before checking again. Repeatedly changing several settings at once makes it harder to establish which change corrected the problem.

A practical verification sequence

For most Active Directory environments, the following sequence is sufficient:

  1. Identify the forest root PDC Emulator.
  2. Run w32tm /query /source and confirm that it reports an approved external peer.
  3. Run w32tm /query /status and confirm a recent successful synchronisation.
  4. Run w32tm /query /configuration and confirm that the effective settings match the intended design.
  5. Check the other domain controllers and confirm that they use domain-based sources.
  6. Check representative member servers and workstations.
  7. Use w32tm /stripchart only where a direct test of a source is required.

The aim is not for every computer to report the same server. The aim is for every valid time path to lead through the hierarchy to the authoritative external source.

Related information