How to configure an authoritative time server in Windows Server about:reader?url=https://support.microsoft.com/en-us/help/816042/how-t...

support.microsoft.com

9-12 minutes

This article decribes how to configure the Windows Time service

and troubleshoot when the Windows Time service doesn't work
correctly.

To configure an internal time server to synchronize with an external

time source, use one of the following methods:

Automatically configure the Windows Time service

To fix this problem automatically, click the Download button. In the

File Download dialog box, select Run or Open, and then follow the
steps in the easy fix wizard.

When you run the easy fix solution to configure an external time
source you will need to specify the name of your NTP server.
The easy fix solution will have the placeholder names of Server1
and Server2. Replace these placeholder names with the name of
your NTP server followed by “,0x1”. i.e SRV1.Contoso.com,0x1.
You do not have to specify more than one server but it is

1 of 7 3/12/2019, 12:09 AM
How to configure an authoritative time server in Windows Server about:reader?url=https://support.microsoft.com/en-us/help/816042/how-t...

recommended to do so for redundancy. If you have multiple entries

they must be separated by a space.

The unit of time for

SpecialPollInterval,MaxPosPhaseCorrectionand MaxNegPhaseCorrection setti
is in seconds.

This wizard may be in English only. However, the automatic fix also
works for other language versions of Windows.

If you’re not on the computer that has the problem, save the easy
fix solution to a flash drive or a CD, and then run it on the computer
that has the problem.

Manually configure the Windows Time service

To configure an internal time server to synchronize with an external

time source, follow these steps:

1. Change the server type to NTP. To do this, follow these steps:

1. Select Start > Run, type regedit, and then select OK.

2. Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\W32Time\Parameters\Type

3. In the pane on the right, right-click Type, and then select Modify.

4. In Edit Value, type NTP in the Value data box, and then select OK.

2. Set AnnounceFlags to 5. To do this, follow these steps:

1. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\W32Time\Config\AnnounceFlags

2. In the pane on the right, right-click AnnounceFlags, and then

select Modify.

3. In Edit DWORD Value, type 5 in the Value data box, and then
select OK.

2 of 7 3/12/2019, 12:09 AM
How to configure an authoritative time server in Windows Server about:reader?url=https://support.microsoft.com/en-us/help/816042/how-t...

Notes

If an authoritative time server that is configured to use an

AnnounceFlag value of 0x5 does not synchronize with an upstream
time server, a client server may not correctly synchronize with the
authoritative time server when the time synchronization between
the authoritative time server and the upstream time server
resumes. Therefore, if you have a poor network connection or other
concerns that may cause time synchronization failure of the
authoritative server to an upstream server, set the AnnounceFlag
value to 0xA instead of to 0x5.

If an authoritative time server that is configured to use an

AnnounceFlag value of 0x5 and to synchronize with an upstream
time server at a fixed interval that is specified in SpecialPollInterval,
a client server may not correctly synchronize with the authoritative
time server after the authoritative time server restarts. Therefore, if
you configure your authoritative time server to synchronize with an
upstream NTP server at a fixed interval that is specified in
SpecialPollInterval, set the AnnounceFlag value to 0xA instead of
0x5.

3. Enable NTPServer. To do this, follow these steps:

1. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\W32Time\TimeProviders\NtpServer

2. In the pane on the right, right-click Enabled, and then

select Modify.

3. In Edit DWORD Value, type 1 in the Value data box, and then
select OK.

4. Specify the time sources. To do this, follow these steps:

1. Locate and then click the following registry subkey:

3 of 7 3/12/2019, 12:09 AM
How to configure an authoritative time server in Windows Server about:reader?url=https://support.microsoft.com/en-us/help/816042/how-t...

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\W32Time\Parameters

2. In the pane on the right, right-click NtpServer, and then

select Modify.

3. In Edit Value, type Peers in the Value data box, and then
select OK.

Note Peers is a placeholder for a space-delimited list of peers from

which your computer obtains time stamps. Each DNS name that is
listed must be unique. You must append ,0x1 to the end of each
DNS name. If you do not append ,0x1 to the end of each DNS
name, the changes that you make in step 5 will not take effect.

5. Configure the time correction settings. To do this, follow these

steps:
1. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\W32Time\Config\MaxPosPhaseCorrection

2. In the pane on the right, right-click MaxPosPhaseCorrection, and

then select Modify.

3. In Edit DWORD Value, click to select Decimal in the Base box.

4. In Edit DWORD Value, type TimeInSeconds in the Value data

box, and then select OK.

Note

TimeInSeconds is a placeholder for a reasonable value, such as 1

hour (3600) or 30 minutes (1800). The value that you select will
depend on the poll interval, network condition, and external time
source.

The default value of MaxPosPhaseCorrection is 48 hours in

4 of 7 3/12/2019, 12:09 AM
How to configure an authoritative time server in Windows Server about:reader?url=https://support.microsoft.com/en-us/help/816042/how-t...

Windows Server 2008 R2 or later.

5. Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\W32Time\Config\MaxNegPhaseCorrection

6. In the pane on the right, right-click MaxNegPhaseCorrection, and

then select Modify.

7. In Edit DWORD Value, click to select Decimal in the Base box.

8. In Edit DWORD Value, type TimeInSeconds in the Value data

box, and then select OK.

Note

TimeInSeconds is a placeholder for a reasonable value, such as 1

hour (3600) or 30 minutes (1800). The value that you select will
depend on the poll interval, network condition, and external time
source.

The default value of MaxNegPhaseCorrection is 48 hours in

Windows Server 2008 R2 or later.

6. Close Registry Editor.

7. At the command prompt, type the following command to restart the

Windows Time service, and then press Enter:
net stop w32time && net start w32time

Note For a list of available time servers, see Microsoft Knowledge

Base article 262680: A list of the Simple Network Time Protocol
(SNTP) time servers that are available on the Internet

5 of 7 3/12/2019, 12:09 AM
How to configure an authoritative time server in Windows Server about:reader?url=https://support.microsoft.com/en-us/help/816042/how-t...

For the Windows Time service to function correctly, the networking

infrastructure must function correctly. The most common problems
that affect the Windows Time service include the following:

There is a problem with TCP/IP connectivity, such as a dead

gateway.

The Name Resolution service is not working correctly.

The network is experiencing high volume delays, especially when

synchronization occurs over high-latency wide area network (WAN)
links.

The Windows Time service is trying to synchronize with inaccurate

time sources.

We recommend that you use the Netdiag.exe utility to troubleshoot

network-related issues. Netdiag.exe is part of the Windows Server
2003 Support Tools package. See Tools Help for a complete list of
command-line parameters that you can use with Netdiag.exe. If
your problem is still not solved, you can turn on the Windows Time
service debug log. Because the debug log can contain very detailed
information, we recommend that you contact Microsoft Customer
Support Services when you turn on the Windows Time service
debug log.

For a complete list of Microsoft Customer Support Services

telephone numbers and information about support costs, go to the
Contact Microsoft website.

Note In special cases, charges that are ordinarily incurred for

support calls may be canceled if a Microsoft Support Professional
determines that a specific update will resolve your problem. The
usual support costs will apply to additional support questions and
issues that do not qualify for the specific update in question.
WAZOO.

6 of 7 3/12/2019, 12:09 AM
How to configure an authoritative time server in Windows Server about:reader?url=https://support.microsoft.com/en-us/help/816042/how-t...

Windows Server includes W32Time, the Time Service tool that is

required by the Kerberos authentication protocol. The Windows
Time service makes sure that all computers in an organization that
are running the Microsoft Windows 2000 Server operating system
or later versions use a common time.

To guarantee appropriate common time usage, the Windows Time

service uses a hierarchical relationship that controls authority, and
the Windows Time service does not allow for loops. By default,
Windows-based computers use the following hierarchy:

All client desktop computers nominate the authenticating domain

controller as their in-bound time partner.

All member servers follow the same process that client desktop
computers follow.

All domain controllers in a domain nominate the primary domain

controller (PDC) operations master as their in-bound time partner.

All PDC operations masters follow the hierarchy of domains in the

selection of their in-bound time partner.

In this hierarchy, the PDC operations master at the root of the forest
becomes authoritative for the organization. We highly recommend
that you configure the authoritative time server to obtain the time
from a hardware source. When you configure the authoritative time
server to sync with an Internet time source, there is no
authentication. We also recommend that you reduce your time
correction settings for your servers and stand-alone clients. These
recommendations provide more accuracy and security to your
domain.

7 of 7 3/12/2019, 12:09 AM