Using the Windows Time Service (w32time)
The Windows Time Service is an NTP based time client built into Windows. With it you can synchronize your computer to an external timeserver.
Beginning with Windows 2000, Windows has included a time synchronization service Windows Time (w32time.exe). W32time is designed to ensure loose synchronization only; the clocks in a network will agree within 20 seconds of one another (for greater accuracy consider ClockWatch Client). This w32time service uses the SNTP protocol and can be used in conjunction with ClockWatch Server. In the Client/Server configuration described below, ClockWatch Server is acting as the network time server for other computers on the network. The following discusses the simple steps to set up a network that keeps in sync:
|Basically, to synchronize a network, you
need a master clock (the time server) and slave clocks (time clients). The timeserver gets the exact time from an external
source and maintains the timeserver at the correct time. It also handles time
requests from the clients.
In this case, both the server and the client are communicating with each other using the SNTP protocol which normally uses User Datagram Protocol (UDP) port 123.
|Steps on configuring ClockWatch Server and Windows Time Client|
|1. Setting up the Time Server|
|2. Setting up the Time Clients:||
Window XP/2008/Vista/Win7/8 –
native win32 time client
Windows 2000 – setsntp
Windows NT – resource kit
Windows 95/98/ME – ClockWatch client
|3. Time Synchronization settings in a Domain|
|4. Starting and Stopping the Time Service|
|5. Turning on logging in the Time Service|
1) Load ClockWatch Server on the designated time server. This does not have to be a "server" other than it should normally be turned on and be visible by all the clients on the local network.
2) Configuring ClockWatch server to act as an SNTP timeserver:
3) Turn off the Windows Time Service on the timeserver. This program will conflict with ClockWatch acting as a time server and must be disabled. You must also change the startup type to 'Manual' to prevent it from starting the next time you reboot Windows. You can administer Services from the Control Panel.
4) The trial version of ClockWatch Server will only accept time requests from a single client. Contact Beagle Software for a free utility to allow your trial timeserver to handle multiple clients.
W32Time is started by default on Windows XP, Windows Server 2008, Windows Vista and Windows 7/8 machines regardless of whether they belong to a workgroup or a domain. On Windows 2000 however, W32Time must be manually started on machines belonging to a workgroup.
If your computer is a member of a domain, your computer clock is probably synchronized automatically by a network time server. If your computer is not a member of a domain, you can synchronize your computer clock with an Internet time server.
This procedure provides information on switching to a different timeserver.
To change the clock synchronization server.
Windows 2000 (Professional and Server) use a time synchronization service to synchronize the date and time of computers running on a Windows 2000-based network.
If you are using
Active Directory -
Turning on the Time Service
|Windows NT||The Win32 Network Time Synchronization Service (W32Time.exe) was not part of the base configuration in Windows NT. It was included in the Windows NT Resource Kit utilities. Refer to the program documentation for configuration to another timeserver. Alternatively, you can use the ClockWatch Client|
The Win32 Network Time Synchronization Service does not run on Windows 95/98/Me. We suggest you use the ClockWatch Client for client time synchronization.
Time Synchronization in a Domain
The following describes how to configure an authoritative time server in Windows 2000/XP/2008/Vista/Win7/8.
Windows includes the W32Time time service tool that is required by the Kerberos authentication protocol. The primary use for such time synchronization is to ensure the security of Kerberos authentication within an Active Directory environment. To prevent replay attacks, Kerberos tickets presented to domain controllers by clients are time-stamped. The authenticating domain controller checks to make sure the timestamp is unique and falls within an allowable skew before accepting the ticket and authenticating the client. The purpose of the time service is to ensure that all computers that are running Windows 2000 or later in an organization use a common time. Administrators can configure an internal time server as authoritative by using the net time command. The time service uses a hierarchical relationship that controls authority.
are members of an Active Directory domain synchronize time with domain
controllers by default. Domain controllers synchronize time with their parent
domain controller. By default, the root parent domain controller will not
synchronize to a time source. The root parent domain controller can be set to
either synchronize to a known and trusted Internet-based time source, or a
hardware time device that provides an NTP or SNTP interface. Its time accuracy
can also be maintained manually.
Windows-based computers use the following hierarchy by default:
All client desktop computers nominate the authenticating domain controller as their in-bound time partner.
All member servers follow the same process as client desktop computers.
Domain controllers may nominate the primary domain controller (PDC) operations master as their in-bound time partner but may use a parent domain controller based on stratum numbering.
All PDC operations masters follow the hierarchy of domains in the selection of their in-bound time partner.
Following this hierarchy, the PDC operations master at the root of the forest becomes authoritative for the organization, and you should configure the PDC operations master to gather the time from an external source. This is logged in the System event log on the computer as event ID 62.
can configure the time service on the PDC operations master at the root of the
forest to recognize an external Simple Network Time Protocol (SNTP) time server
as authoritative by using the following net time command with the
setsntp option, where server_name is the DNS server name:
net time /setsntp:server_name
you can use the server's IP address:
net time /setsntp:server_IP
For example, if
the server name was 'beagle' you would issue the following command:
net time /setsntp:beagle
You can then test
the connection by typing:
Setting the Domain Client
You can use your ClockWatch time server (clockwatch_server_name) for this function. After you set the SNTP time server as authoritative, run either of the following commands on a computer other than the domain controller to reset the local computer's time against the authoritative time server, where clockwatch_server_name is the network name of your ClockWatch time server:
net time /clockwatch_server_name /set
following commands, pressing ENTER after each command:
net stop w32time
net start w32time
For more information about the net time command type:
net time /?
Reference: Microsoft KB articles: 224799, 216734, 31054
To manually start W32Time using the Control Panel:
From the Start menu, point to Settings, and then click Control Panel.
Double-click Administrative Tools, and then double-click Services.
Select Windows Time from the list of services.
On the Action menu, click Start to begin the service.
To manually stop W32Time using the Control Panel:
Follow steps 1 through 3 in the previous procedure.
On the Action menu, click Stop to discontinue the service.
Change the Startup type from 'Automatic' to 'Manual' to prevent Windows time from starting automatically the next time you reboot.
The Windows Time listing in the Services applet of the Windows Control Panel
You can turn on debug logging for the Windows Time service (also known as W32time). Logging provides a detailed trace of what the otherwise stoical time service is doing. If you are an administrator, you can use the debug logging feature of the Windows time service to help troubleshoot connection and time server issues.
Turn On Debug Logging for the
Windows Time Service
To turn logging on you need to add three entries to the Windows Registry on the computer you wish to trace.
Registry Editor, regedit
Locate and then
click the following registry key:
On the Edit
menu, click New Value, and then add the following 3 registry values:
Data Type: DWORD
Value data: 10000000
Meaning: Maximum log file size.
This registry value specifies the size of the log file in bytes.
A value of 10000000 bytes will limit the log file to approximately 10 MB.
Data Type: String
Value data: C:\Windows\Temp\w32time.log
Meaning: Full file and path name of log file.
This registry value specifies the location of the log file. The path is not fixed. You can use a different path.
Data Type: String
Meaning: Debug level: log all entries within the range of 0 and 116.
This registry value specifies the level of detail of the information in the debug log.
Note The Data Type value must be of type REG_SZ (String). You must type the value exactly as shown (that is, type 0-116). The highest possible value is 0-300 for most detailed logging.
The log will start immediately. There is lots of information in the log; of specific interest is the NTP packet information.
Here's a sample NTP packet of a Windows time client using ClockWatch Server as a time server:
148402 09:25:56.2316165s - /-- NTP Packet:
148402 09:25:56.2316165s - | LeapIndicator: 0 - no warning; VersionNumber: 3; Mode: 4 - Server; LiVnMode: 0x1C
148402 09:25:56.2316165s - | Stratum: 1 - primary reference (syncd by radio clock)
148402 09:25:56.2316165s - | Poll Interval: 4 - 16s; Precision: -18 - 3.8147æs per tick
148402 09:25:56.2316165s - | RootDelay: 0x0010.0025s - 16.0006s; RootDispersion: 0x0000.0300s - 0.0117188s
148402 09:25:56.2316165s - | ReferenceClockIdentifier: 0x434C4B57 - source name: "CLKW"
148402 09:25:56.2316165s - | ReferenceTimestamp: 0xC9D99CEFE72A6B0D148402 09:25:56.2316165s - - 12821966703902991000ns - 148402 09:25:03.9029910s
148402 09:25:56.2316165s - | OriginateTimestamp: 0xC9D99D24374B2FA9148402 09:25:56.2316165s - - 12821966756215991000ns - 148402 09:25:56.2159910s
148402 09:25:56.2316165s - | ReceiveTimestamp: 0xC9D99D22E7AE0000148402 09:25:56.2316165s - - 12821966754904998800ns - 148402 09:25:54.9049988s
148402 09:25:56.2316165s - | TransmitTimestamp: 0xC9D99D22E7AE0000148402 09:25:56.2316165s - - 12821966754904998800ns - 148402 09:25:54.9049988s
148402 09:25:56.2316165s - >-- Non-packet info:
148402 09:25:56.2316165s - | DestinationTimestamp: 148402 09:25:56.2316165s - 0xC9D99D243B4B380C148402 09:25:56.2316165s - - 12821966756231616500ns148402 09:25:56.2316165s - - 148402 09:25:56.2316165s
148402 09:25:56.2316165s - | RoundtripDelay: 15625500ns (0s)
148402 09:25:56.2316165s - | LocalClockOffset: -1318804900ns - 0:01.318804900s
148402 09:25:56.2316165s - \--
This is a stratum 1 timeserver, that is has been synced to a stratum 0 time source (see below). Also note the reference clock identifier field has "CLKW", this is the server identifier used by ClockWatch. Also note that the timestamps all have values. NTP uses these values to calculate the time difference and the reliability of the timeserver. If your packets show lots of 0s then check to see if your timeserver is working properly.
To turn logging off, simply delete the three entries in the registry.
Reference: Microsoft KB article: 81643
Other w32time Settings
The Windows time
service has a lot of functionality but the administration is very nity gritty.
By manipulating registry settings for the service, w32time can act as both an
SNTP client and server to synchronize other network clients.
Contains a list of parameters for w32time
Set value to NTP.
Set the value to 5 for reliable time source
Set this to the period in seconds that the Windows machine should poll the NTP server. A recommended value is 900 seconds (decimal) which equates to every 15 minutes.
Turn on NTP Server:
Change this value to 1 to enable the NTP server.
Specify list of External Timeservers:
In this field you can provide a list of IP address or DNS names, separated by a space, of NTP servers that the Windows machine can synchronize to.