The basic Windows Time Service is the same on standalone systems and domain controllers. Both can use a manual list of NTP peers, both are managed with w32tm, and both should be checked to confirm that the intended source is actually being used.
The important difference is authority. The PDC Emulator in the forest root domain provides time to the rest of the Active Directory hierarchy. A standalone server or workstation is normally responsible only for maintaining its own clock, unless it has deliberately been configured to provide NTP service to other devices.
Standalone Windows computers use the NTP synchronisation type by default rather than NT5DS. There is no domain controller from which they can discover time automatically, so the quality of the result depends on the configured peer list and whether those peers remain reachable.
Standalone Windows servers
A standalone Windows server should be treated in much the same way as the forest root PDC Emulator. It should use several reliable NTP peers, the selected source should be verified after configuration, and the time service should be checked after significant network or firewall changes.
This is particularly important for servers providing applications, databases, virtualisation, backup or certificate services. Even without Active Directory, inaccurate time can affect licensing, scheduled tasks, log correlation, certificates and communication with external services.
A Hyper-V host is a good example. New virtual machines can inherit the host clock before their own time configuration becomes active. A badly incorrect host can therefore create problems during installation or activation even when the guests later synchronise correctly.
The detailed configuration is covered in Configuring Windows Time on a Standalone Server.
Standalone workstations and laptops
A standalone workstation usually has less demanding requirements. The default Windows Internet time configuration may be sufficient where the computer has regular Internet access and does not provide services to other systems.
There is still value in selecting a known source and checking that synchronisation is working, particularly for computers used with certificates, cloud services, VPN authentication or time-sensitive applications.
Laptops can spend long periods asleep or disconnected from the Internet. Their clocks may not be corrected until the Windows Time Service has network access and receives a usable response. A small difference is rarely important, but a large error can prevent authentication or make event and file timestamps misleading.
Workstation guidance is covered in Windows Time on Standalone Workstations.
Workgroup environments
A workgroup containing several Windows computers has no automatic hierarchy. Each system can be configured independently, but using the same approved NTP sources makes the environment easier to understand and support.
Small environments may already contain a suitable local source, such as a firewall, router, NAS, network appliance or Linux server running Chrony. Where that device has a reliable upstream source, pointing the Windows systems at it can reduce external dependencies and keep local clocks consistent.
This should still be treated as a deliberate design. The local device must itself be synchronised, monitored and available. Pointing every computer at an unverified router simply moves the problem to another box.
Further guidance is available in Windows Time in a Workgroup.
Choosing a time source
A standalone system can use several types of source:
- The NTP Pool Project.
- A public service operated by a recognised organisation.
- An internal firewall, router, NAS or network appliance.
- A dedicated commercial time appliance.
- A local GPS-backed NTP server.
The best choice depends on availability, support requirements, security and whether the system must continue operating accurately during an Internet outage. Millisecond accuracy is unnecessary for most ordinary Windows servers and workstations; a reliable and understandable source is usually more important.
The available options are covered in the Time Sources section.
The Linux equivalent
Many local NTP servers are built on Linux rather than Windows. Current Linux systems commonly use Chrony, systemd-timesyncd or, on older installations, the traditional ntpd service.
Chrony is particularly suitable for systems that act as a local time server or use a GPS receiver. A Windows server can use a Chrony host as a normal NTP peer; Windows does not need to know which software is providing the service.
For administrators more familiar with Windows, tools such as TICC-DASH can provide a web view of the clients contacting a Chrony server. This is useful for confirming that Windows systems are reaching the local NTP host, although each Windows computer should still be checked with w32tm /query /source to confirm that it has selected that source.
Linux time services and their use with Windows will be covered separately in the Linux Time Services section.
Topics in this section
Configuring Windows Time on a Standalone Server
Configure multiple NTP peers, apply the settings and verify that a server is using the intended source.
Windows Time on Standalone Workstations
Understand the default Windows behaviour and when a workstation or laptop requires manual configuration.
Windows Time in a Workgroup
Keep several non-domain Windows computers consistent without creating an unnecessary or unreliable hierarchy.