Check Windows Time Settings

Mark Berry May 7, 2010

In a small Windows 2003 R2 domain environment, I had the following error in the System event log on a Windows XP Pro client:  W32Time, Warning, Event ID 36: The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized.

So how do I check where W32Time is looking for its time providers?

The Windows Time Service now uses the w32tm command-line utility to configure the service. Unfortunately, running w32tm /config does not display the current configuration. Instead it simply tells you, No configuration change specified!

Well, configuration changes are no doubt stored in the registry, but where? w32tm does provide a registry dumper. By default, w32tm /dumpreg shows you the contents of

HKLM\System\CurrentControlSet\Services\W32Time

If you want to see settings in subkeys to that key, you must use the /subkey parameter. For example, w32tm /dumpreg /subkey:Parameters will list values from this key:

HKLM\System\CurrentControlSet\Services\W32Time\Parameters

/syncfromflags

In my case, I want to confirm that the client is configured to receive its time from the domain controller. It’s clear from the w32tm command descriptions (w32tm /?) that I can configure the domain source by typing w32tm /config /syncfromflags:DOMHIER. But how do I check the value without changing it?

Through trial and error on another computer, I was able to confirm that the /syncfromflags parameter is controlling this registry value

HKLM\System\CurrentControlSet\Services\W32Time\Parameters\Type

In particular:

/syncfromflags:DOMHIER sets Type to NT5DS
/syncfromflags:MANUAL sets Type to NTP
/syncfromflags:MANUAL,DOMHIER sets Type to AllSnync

So now, finally, I can run w32tm /dumpreg /subkey:Parameters, check value of Type, and know whether Windows Time is looking to the domain controller, the manually-configured peer list, or both as its time provider.