How to Sync Time with Domain Controller on Windows

7.9K

In this post we’ll cover how to sync time on a client device with the AD domain and how to troubleshoot when things go wrong.

Why Time Synchronization Matters in Active Directory

Windows computers must have their time synchronized with the domain in order to function properly in Active Directory. If the time on a client computer is out of sync with the domain, this can cause a number of problems. The most critical are related to the failure of Kerberos authentication and access to the resource if the time on a client computer is more than 5 minutes off from the domain controller.

Keep in mind that incorrect time sync may also affect certificate validation, token signing, and modern security protocols that rely on accurate system time.

Understanding the Time Hierarchy in the Active Directory Domain

By default, all domain-joined computers automatically sync their time with the domain controller according to the strict Active Directory domain hierarchy.

1. Workstations and member-servers use their authenticating Domain Controller (LogonServer) as the time source (in accordance with AD sites and subnets configuration);
2. All domain controllers sync their time with the DC holding the PDC Emulator FSMO role;
3. The PDC Emulator in the forest root domain is the authoritative root of the AD time hierarchy. It should sync with a reliable external time source (such as an NTP server). Other DCs and domain members sync through the AD domain hierarchy.
4. In a multi-domain AD forest, the PDC emulator in each domain sync its time with the PDC in the forest root domain.

Configuring the Forest Root PDC as the Authoritative Time Source

The PDC Emulator in the forest root domain should sync with a reliable external NTP source and be configured as a reliable time source for the AD time hierarchy.

On the forest-root PDC Emulator, run the following commands from an elevated Command Prompt:

w32tm /config /manualpeerlist:"ntp1.example.com,0x8 ntp2.example.com,0x8" /syncfromflags:manual /reliable:yes /update
w32tm /config /update
w32tm /resync

Don’t forget to replace the example NTP servers with the time sources approved for your environment. The /reliable:yes parameter marks the PDC as a reliable time source. Other DCs prefer reliable time sources when selecting a time sync partner.

Learn more about time syncing in an Active Directory domain using the GPO.

Time Sync Considerations for Virtual Machines and Hybrid Environments

Modern Windows environments often run DCs and clients as VMs. In virtualized or hybrid infrastructures, additional time sync mechanisms may affect the Windows Time service behavior.

Starting with Windows Server 2016, Windows includes the Secure Time Seeding (STS) feature, which uses SSL/TLS time metadata in order to help estimate the correct system time when the clock is significantly inaccurate.

Microsoft has reported timekeeping issues associated with STS in some Windows Server deployments. For Windows Server 2016 and later, Microsoft recommends evaluating whether to disable STS on servers with time-sensitive workloads (including Active Directory DCs and virtualization hosts).

Windows Server 2025 has STS disabled by default. You should verify the STS config and ensure that reliable time sync and monitoring are in place.

Disable Secure Time Seeding on Windows Server

Microsoft recommends evaluating the Secure Time Seeding config on Windows Server 2016 and later (especially on DCs, virtualization hosts, and servers running time-sensitive workloads).

In case your environment has reliable time sync and monitoring, you can disable STS through Group Policy or the registry. You can control the STS config with the following registry value:

HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config\UtilizeSslTimeData

Here are the possible values:

• 0: Secure Time Seeding disabled.
• 1: Secure Time Seeding enabled.

After configuring, you need to restart a system restart in order to take full effect for the changes.

To disable STS using registry, run the following commands:

reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config" /v UtilizeSslTimeData /t REG_DWORD /d 0 /f

shutdown /r /t 60 /c

Important. Keep in mind that Secure Time Seeding is disabled by default in Windows Server 2025. You should check the UtilizeSslTimeData config in your environment, especially when applying Group Policy/standardized server config baselines. You can enable/disable the policy by navigating to Computer Configuration > Administrative Templates > System > Windows Time Service.

Note that in Hyper-V environments, VMs may also receive time updates through the Hyper-V Time Synchronization Integration Service (this can conflict with the Windows Time service config, especially on DCs). For Hyper-V virtualized DCs, you need to disable the Time Synchronization integration service for all DC VMs, including the PDC Emulator. This prevents the Hyper-V host from acting as an additional time source for the DC.

The virtualized DC should sync time through the AD domain hierarchy. You should config the PDC Emulator in the forest root domain to use a reliable external time source.

Disable Hyper-V Time Synchronization for Domain Controllers

In order to disable host-to-guest time sync on a Hyper-V virtualized DC, follow the steps below:

1. Shut down the VM.
2. Open Hyper-V Manager.
3. Right-click the domain controller VM and select Settings.
4. Open Management > Integration Services.
5. Clear the Time Synchronization checkbox.
6. Apply the changes and start the VM.
7. Check if the DC sync time through the AD domain hierarchy.

For virtualized DCs, we recommend using the standard AD time hierarchy and carefully configuring hypervisor-based time sync features. You need to give special attention to the DC that is holding the PDC Emulator FSMO role (because it acts as the authoritative time source for the entire AD domain).

In VMware environments, you should disable host-to-guest time sync for virtualized DCs and use the AD time hierarchy. Config the PDC Emulator in the forest root domain to sync with a reliable external time source.

In cloud and hybrid environments, you need to carefully design the time sync architecture for virtualized DCs. Identify the authoritative time source and avoid conflicting time sync mechanisms. Azure VMs and other cloud platforms may have platform-specific time sync behavior, so follow the relevant provider documentation when configuring virtualized DCs. Keep in mind that restoring VM snapshots, Hyper-V checkpoints, or paused VMs may introduce significant clock drift and replication inconsistencies in AD environments. Large backward time shifts on DCs may lead to Kerberos authentication failures, replication skew, and USN rollback-like symptoms.

Sync Time with DC on the Domain-Joined Machine

By default, Windows computers automatically sync time with their authenticating DC according to AD site topology. In most cases, no additional manual action is required to sync the time with domain.

On a Windows 10/11 computer, check the current time source and sync status. Go to Settings > Time and Language > Date & time > Additional settings and make sure your DC is used as the last time sync source.

Windows provides only limited graphical controls for the Windows Time service (W32Time), so advanced configuration is usually performed from the command line (w32tm command), from the registry (HKLM\ System\ CurrentControlSet\ Services\ W32Time\ Parameters), or via Group Policy.

Viewing and Configuring Windows Time Service with W32tm

To check and configure the time sync settings from the command prompt, use the w32tm command. Get the current time source on a computer:

w32tm /query /source

This command should return the name of one of the AD domain controllers on a domain-joined machine:

View the detailed time setting and last sync time:

w32tm /query /status

Forcing Time Synchronization with Domain Controller

Force a time sync with DC:

w32tm /resync /rediscover

If the time synchronization is successful, Event ID 37 should appear in the Event Viewer with the Time-Service source:

The time provider NtpClient is currently receiving valid time data from dc01.theitpro.loc (ntp.d|0.0.0.0:123->192.168.8.10:123).

Make sure that the computer is configured to automatically synchronize its time according to the domain hierarchy:

w32tm /query /configuration

Scroll down to the [TimeProviders] sections and ensure that the Type is set to NT5DS. If not, this may be the cause of time sync problems on a computer.

This value can also be found in the Type parameter under the registry key HKLM\ SYSTEM\ CurrentControlSet\ Services\ W32Time\ Parameters. The NtpServer value is ignored when NT5DS is used.

Resetting Windows Time Service configuration

In order to config a domain-joined computer to sync time through the AD domain hierarchy, run the command:

# CMD
w32tm /config /syncfromflags:domhier /update

# PowerShell
Restart-Service W32Time
w32tm /resync /rediscover

This configures Windows Time to use the AD domain hierarchy as its time source (NT5DS). Note that it does not reset all Windows Time Service settings to their default values.

In case the Windows client fails to sync time with the AD domain hierarchy, try reconfiguring the time source and restarting the service first. Unregistering and registering the service should be used as an advanced recovery step. To unregister the Windows Time service, run the command:

w32tm /unregister

Register the Windows Time service:

w32tm /register

Now restart the service and config it to use the AD domain hierarchy:

Restart-Service W32Time
w32tm /config /syncfromflags:domhier /update
w32tm /resync /rediscover

Restarting W32Time service

Restart the Windows Time service and apply the existing config:

Restart-Service W32Time
w32tm /config /update
w32tm /resync

In order to check the time synch status, use the command:

w32tm /query /source
w32tm /query /status

In case the machine must use the AD domain hierarchy, explicitly config it as follows:

w32tm /config /syncfromflags:domhier /update
Restart-Service W32Time
w32tm /resync /rediscover

Time Sync Issues on Windows Domain Joined Computers

Checking W32Time Service Status

The Windows Time Service (W32Time) is responsible for time synchronization. Check that this service is running on a client with Get-Service:

Get-Service W32Time | Select-Object name,status

You can restart the Windows Time service with PowerShell command:

Restart-Service W32Time

UDP port 123 is used for time synchronization on Windows. If the port is closed, the w32tm /resync command will return an error:

Sending resync command to local computer
The computer did not resync because no time data was available.

In this case, the following entry appears in the Event Viewer log:

EventID: 129

Source: Time-Service

NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: The entry is not found. (0x800706E1)

In order to check Windows Time Service events, run the command:

Get-WinEvent -LogName System |
Where-Object {
$_.Id -in 37,129 -and
$_.ProviderName -eq 'Microsoft-Windows-Time-Service'
} |
Select-Object TimeCreated, Id, Message

Checking UDP Port 123 Connectivity

Check that the w32time service is running on the DC and listening on UDP port 123:

netstat -an | find "UDP" | find ":123"

Then check that the UDP inbound rule named Active Directory Domain Controller – W32Time (NTP-UDP-In) is enabled in Windows Defender Firewall (Control Panel > Windows Firewall > Advanced settings > Inbound rules).

Checking Firewall Rules

To check Windows Defender Firewall rule status with PowerShell, run the command:

Get-NetFirewallRule | Where-Object DisplayName -like '*W32Time*' | Select-Object DisplayName, Enabled

If the rule is disabled, you must enable it:

Get-NetFirewallRule | Where-Object DisplayName -like '*W32Time*' | Enable-NetFirewallRule

Forcing Sync with a Specific DC

It is also possible to force a client to sync its time with a specific DC using w32tm:

w32tm /config /manualpeerlist:ny-dc01 /syncfromflags:manual /update
w32tm /resync

In order to switch the client back to the AD domain hierarchy time source, run the command:

w32tm /config /syncfromflags:domhier /update
w32tm /resync

You can use the following command to compare time offsets between DCs:

w32tm /monitor

You can monitor time drift against a specific DC with the command:

w32tm /stripchart /computer:dc01 /samples:10 /dataonly

You should use w32tm /stripchart to measure the current time offset between the client and the DC in real time.

Troubleshooting Time Drift on Virtual Machines

In case time drift occurs on VMs, you should check if the hypervisor tools/integration services are syncing time independently from Windows Time Service (W32Time). Note that multiple active time providers may cause clock drift, Kerberos authentication failures, and AD replication problems. Only one authoritative time sync mechanism should control the VM clock.

Configuring the NTP Client Time Sync on Windows Using GPO

In most cases, time sync with a domain on Windows client doesn’t require administrator intervention. However, if you find that time synchronization is not working properly on client workstations in domain, it is possible to centrally configure client time sync settings using Group Policy.

Editing policies with gpedit.msc

1. Use the gpedit.msc console to change Group Policy settings on a single computer (this is the best solution if you need to solve synchronization problems on a single computer or test new time sync settings). To set up a GPO for multiple domain computers, use the Group Policy Management Console (gpmc.msc);
2. Expand the following node in GPO editor: Computer Configuration > Administrative Templates > System > Windows Time Service;
3. Enable the Enable Windows NTP Client policy;

   

4. Then enable the Configure NTP Client policy. For ordinary domain-joined computers and member servers, configure the following setting:

   Type: NT5DS

   This configures Windows Time Service to use the AD domain hierarchy. Do not specify an external NTP server for ordinary domain members when using NT5DS. The NtpServer setting is used when the time synchronization type is NTP.

   

5. Restart your computer to apply the new GPO client time settings.

Note. SpecialPollInterval parameter applies only when Type is set to NTP. In case you are using NT5DS (domain hierarchy), polling intervals are dynamically managed by the Windows Time Service based on clock accuracy.