Académique Documents
Professionnel Documents
Culture Documents
Page 1
Search
Article ID
: 816042
Last Review : May 15, 2007
Revision
: 7.1
On This Page
INTRODUCTION
Configuring the Windows Time service to use an internal hardware clock
Configuring the Windows Time service to use an external time source
Troubleshooting
MORE INFORMATION
Reliable time source configuration
Manually-specified synchronization
All available synchronization mechanisms
Windows Time service registry entries
REFERENCES
INTRODUCTION
Windows includes W32Time, the Time Service tool that is required by the Kerberos authentication protocol. The purpose of the
Windows Time service is to make sure that all computers that are running Microsoft Windows 2000 or later versions in an
organization use a common time.
To guarantee appropriate common time usage, the Windows Time service uses a hierarchical relationship that controls authority,
and the Windows Time service does not permit loops. By default, Windows-based computers use the following hierarchy:
All client desktop computers nominate the authenticating domain controller as their in-bound time partner.
All member servers follow the same process that client desktop computers follow.
All domain controllers in a domain nominate the primary domain controller (PDC) operations master as their in-bound time
partner.
All PDC operations masters follow the hierarchy of domains in the selection of their in-bound time partner.
In this hierarchy, the PDC operations master at the root of the forest becomes authoritative for the organization. We highly
recommend that you configure the authoritative time server to gather the time from a hardware source. When you configure the
authoritative time server to sync with an Internet time source, there is no authentication. We also recommend that you reduce your
time correction settings for your servers and stand-alone clients. These recommendations provide more accuracy and security to
your domain.
http://support.microsoft.com/kb/816042
02/26/2008 01:49:10 PM
Page 2
d. In Edit Value, type NTP in the Value data box, and then click OK.
2
.
3
.
In Edit DWORD Value, type 5 in the Value data box, and then click OK.
http://support.microsoft.com/kb/816042
02/26/2008 01:49:10 PM
Page 3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer
b. In the right pane, right-click Enabled, and then click Modify.
c.
4
.
In Edit DWORD Value, type 1 in the Value data box, and then click OK.
In Edit Value, type Peers in the Value data box, and then click OK.
Note Peers is a placeholder for a space-delimited list of peers from which your computer obtains time stamps. Each
DNS name that is listed must be unique. You must append ,0x1 to the end of each DNS name. If you do not
append ,0x1 to the end of each DNS name, the changes made in step 5 will not take effect.
5
.
c.
In Edit DWORD Value, type TimeInSeconds in the Value data box, and then click OK.
Note TimeInSeconds is a placeholder for the number of seconds that you want between each poll. A recommended
value is 900 Decimal. This value configures the Time Server to poll every 15 minutes.
6
.
d. In Edit DWORD Value, type TimeInSeconds in the Value data box, and then click OK.
Note TimeInSeconds is a placeholder for a reasonable value, such as 1 hour (3600) or 30 minutes (1800). The value
that you select will depend upon the poll interval, network condition, and external time source.
e. Locate and then click the following registry subkey: HKEY_LOCAL_
MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\MaxNegPhaseCorrection
f.
8
.
At the command prompt, type the following command to restart the Windows Time service, and then press ENTER:
net stop w32time && net start w32time
Troubleshooting
For the Windows Time service to function correctly, the networking infrastructure must function correctly. The most common
problems that affect the Windows Time service include the following:
http://support.microsoft.com/kb/816042
02/26/2008 01:49:10 PM
Page 4
The Windows Time service is trying to synchronize with inaccurate time sources.
We recommend that you use the Netdiag.exe utility to troubleshoot network-related issues. Netdiag.exe is part of the Windows
Server 2003 Support Tools package. See Tools Help for a complete list of command-line parameters that you can use with
Netdiag.exe. If your problem is still not solved, you can turn on the Windows Time service debug log. Because the debug log can
contain very detailed information, we recommend that you contact Microsoft Product Support Services when you turn on the
Windows Time service debug log.
For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following
Microsoft Web site:
http://support.microsoft.com/default.aspx?scid=fh;[LN];CNTACTMS (http://support.microsoft.com/default.aspx?scid=fh;%5Bln%
5D;cntactms)
Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional
determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and
issues that do not qualify for the specific update in question.
MORE INFORMATION
NTP supports several different packet types. Typically, NTP clients and Simple Network Time Protocol (SNTP) clients send client
mode request packets to an NTP server. The NTP server responds with a server mode packet. To configure the W32time service to
send symmetric active mode packets instead of client mode packets to an NTP server, type the following command at a command
prompt:
w32tm /config /manualpeerlist:<server>,0x4 /syncfromflags:MANUAL
Note Use the 0x8 flag to force W32time to send normal client requests instead of symmetric active mode packets. The NTP servier
replies to these normal client requests as usual.
Manually-specified synchronization
With manually-specified synchronization, you can designate a single peer or list of peers that a computer obtains time from. If the
computer is not a member of a domain, it must be manually configured to synchronize with a specified time source. By default, a
computer that is a member of a domain is configured to synchronize from the domain hierarchy. Manually-specified synchronization
is most useful for the forest root of the domain or for computers that are not joined to a domain. When you manually specify an
external NTP server to synchronize with the authoritative computer for your domain, you provide reliable time. However, to provide
high accuracy and security to your domain, we recommend that you configure the authoritative computer for your domain to
synchronize with a hardware clock.
Without a hardware time source, W32time is configured as a NTP type. You must reconfigure the MaxPosPhaseCorrection and
MaxNegPhaseCorrection registry entries. The recommended value should be 15 minutes or even lower, depending on time source,
network condition, and security requirement. This requirement also applies to any reliable time source that is configured as the
forest root time source in the time sync subnet. For more information about these registry entries, see the "Windows Time service
registry entries" section in this article.
Note Manually-specified time sources are not authenticated unless a specific time provider is written for them, and these time
sources are therefore vulnerable to attacks. Also, if a computer synchronizes with a manually-specified source instead of its
authenticating domain controller, the two computers might be out of synchronization. This scenario causes Kerberos authentication
to fail and could also cause other actions that require network authentication to fail, such as printing or file sharing. If only the forest
root is configured to synchronize with an external source, all other computers within the forest remain synchronized with each other.
This configuration makes replay attacks difficult.
http://support.microsoft.com/kb/816042
02/26/2008 01:49:10 PM
Page 5
MaxPosPhaseCorrection
Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
Notes
This entry specifies the largest positive time correction in seconds that the service makes. If the service determines
that a change that is larger than this is required, the service logs an event. (0xFFFFFFFF is a special case that means
always make a time correction.) The default value for domain members is 0xFFFFFFFF. The default value for standalone clients and servers is 54,000 or 15 hours.
Registry
Entry
MaxNegPhaseCorrection
Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
Notes
This entry specifies the largest negative time correction in seconds that the service makes. If the service determines
that a change that is larger than this is required, the service logs an event instead. (-1 is a special case that means
always make a time correction.) The default value for domain members is 0xFFFFFFFF. The default value for standalone clients and servers is 54,000 or 15 hours.
Registry
Entry
MaxPollInterval
Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
Note
This entry specifies the largest interval, in log seconds, that is allowed for the system polling interval. While a system
must poll according to the scheduled interval, a provider can refuse to produce samples when requested. The default
value for domain members is 10. The default value for stand-alone clients and servers is 15.
Registry
Entry
SpecialPollInterval
Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient
Note
This entry specifies the special poll interval in seconds for manual peers. When the SpecialInterval 0x1 flag is enabled,
W32Time uses this poll interval instead of a poll interval that is determined by the operating system. The default value
on domain members is 3,600. The default value on stand-alone clients and servers is 604,800.
Registry
Entry
MaxAllowedPhaseOffset
Path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
Note
This entry specifies the maximum offset, in seconds, for which W32Time tries to adjust the computer clock by using
the clock rate. When the offset is greater than this rate, W32Time sets the computer clock directly. The default value
for domain members is 300. The default value for stand-alone clients and servers is 1.
REFERENCES
For more information about Windows Time service, click the following article numbers to view the articles in the Microsoft
Knowledge Base:
816043 (http://support.microsoft.com/kb/816043/) How to turn on debug logging in the Windows Time service
884776 (http://support.microsoft.com/kb/884776/) Configuring the Windows Time service against a large time offset
321708 (http://support.microsoft.com/kb/321708/) How to use the Network Diagnostics Tool (Netdiag.exe) in Windows 2000
314054 (http://support.microsoft.com/kb/314054/) How to configure an authoritative time server in Windows XP
216734 (http://support.microsoft.com/kb/216734/) How to configure an authoritative time server in Windows 2000
http://support.microsoft.com/kb/816042
02/26/2008 01:49:10 PM
Page 6
For more information about the Windows Time service in a Windows Server 2003-based forest, visit the following Microsoft Web
site:
http://technet2.microsoft.com/windowsserver/en/library/A0FCD250-E5F7-41B3-B0E8-240F8236E2101033.mspx
APPLIES TO
Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
Microsoft Windows Server 2003, Standard Edition (32-bit x86)
Microsoft Windows Server 2003, Web Edition
Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
Keywords: kbsecurity kbhowto KB816042
2008 Microsoft Corporation. All rights reserved.
http://support.microsoft.com/kb/816042
02/26/2008 01:49:10 PM