Today we will talk about time synchronization best practices for virtualized AD domain controllers running on modern versions of Windows Server (including Windows Server 2022 and Windows Server 2025). Typically, the time synchronization scheme in the Active Directory domain is as follows:
- The PDC emulator is the main time source on the domain and must be configured to synchronize time with the external time source;
- All other domain controllers are synchronized with the controller that owns the PDC emulator role;
- All member servers and workstations synchronize their time with the nearest domain controller.
Tip. For more information about configuring NTP time in a domain, see the article Configure NTP Time Sync using Group Policy.
Challenges with Time Synchronization in Virtualized Domain Controllers
A virtualized domain controller introduces unique challenges when it comes to time synchronization vs a physical domain controller. Since they’re hosted on a virtual machine, they’re subject to the host computer’s time settings. This becomes a problem if there is a discrepancy between the host Windows operating system and the guest operating system running on the virtual machine. Therefore, it becomes necessary to disable time synchronization between the host and the guest virtual machine to prevent potential inconsistencies.
Virtual Machine Generation ID and Modern DCs
Prior to Windows Server 2012, in case you were restoring a virtual DC from a snapshot, then you could face serious AD replication problems (including USN rollback issues).
Modern virtualization platforms (such as Hyper-V and VMware) support Virtual Machine Generation ID (VM-GenerationID). It allows AD to detect snapshot restores, cloning operations, and other virtualization events.
When a supported DC detects a Generation ID change, it automatically protects the AD database by updating replication metadata and preventing replication inconsistencies.
Generally, VM Generation ID significantly improves the safety of virtualized DC, but we still recommend you to config time sync correctly and avoid dependence on the virtualization host as the primary time source for DCs.
Time Configuration and The PDC Emulator Role
In every Active Directory domain, one domain controller holds the Primary Domain Controller (PDC) emulator role. This architecture remains unchanged in Windows Server 2022 and Windows Server 2025 and continues to be Microsoft’s recommended approach for AD time sync. This domain controller becomes the authoritative time server for the entire domain, including all other domain controllers and member servers. It’s crucial to ensure that the domain controller holding the PDC emulator role has the correct time. If this domain controller’s time drifts, the entire active directory database could experience issues.
Time Accuracy in Modern Windows Server Versions
Starting with Windows Server 2016, Microsoft significantly improved the accuracy of the Windows Time Service (W32Time). Modern Windows Server releases (including Windows Server 2022 and Windows Server 2025), can achieve millisecond-level accuracy when properly configured.
Accurate time sync is particularly important for enterprise workloads such as Kerberos authentication, Hyper-V clusters, SQL Server Always On availability groups, and other distributed applications that rely on consistent timestamps across multiple systems.
Because of these requirements, keep in mind that maintaining a reliable time hierarchy and correctly configuring virtualized DCs is more important than ever in modern AD environments.
Modern Windows Time Service Enhancements
Starting with Windows Server 2016, Microsoft introduced several improvements to the Windows Time Service (W32Time), including Secure Time Seeding (STS).
Secure Time Seeding helps systems recover from significant time drift by using trusted SSL/TLS-based timestamps obtained during secure network communications. Secure Time Seeding is a supplementary mechanism and you should not consider it as a replacement for properly configured NTP infrastructure in AD environments.
In AD environments, you should continue to rely on a properly configured PDC emulator and authoritative NTP sources, while Secure Time Seeding serves as a supplemental safeguard in modern Windows Server deployments.
Important. Microsoft recommends disabling Secure Time Seeding (STS) on Windows Server 2016, 2019, and 2022, particularly on AD DS domain controllers, VM hosts, and other time-sensitive workloads. STS is disabled by default on Windows Server 2025, so on Server 2025 you normally only need to verify that it remains disabled. If STS was explicitly enabled through the UtilizeSslTimeData setting, disable it and restart the server. Before changing STS settings, review Microsoftโs current recommendations and test the change in your environment.
reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config /v UtilizeSslTimeData /t REG_DWORD /d 0 /fYou will need a system restart for the STS setting to take effect.
Configure Secure Time Seeding using Group Policy
When you are working with an enterprise AD environment, you can manage the Secure Time Seeding config centrally using Group Policy instead of changing the registry manually on individual DCs.
To do this. open the Group Policy Management Console (GPMC) and navigate to Computer Configuration โ Administrative Templates โ System โ Windows Time Service โ Global Configuration Settings.
Here you need to config the Enable Secure Time Seeding policy according to your organization’s requirements. A domain-wide GPO allows the setting to be applied consistently to multiple DCs and other managed Windows systems.
After applying the policy, you need to check the resulting W32Time config using the following command:
w32tm /query /configuration
In case the setting is managed by Group Policy, you should avoid making conflicting manual registry changes on individual servers. Use GPO for the authoritative config and check the effective settings on the affected machines.
Configuring Time Synchronization in a Virtualized Environment
The key to proper time configuration in a virtualized domain lies in the configuration of the domain controller virtual machine. To prevent the guest domain controller from syncing its time with the host operating system, disable time synchronization via integration services. Modifying the registry key under system current control set services w32time time providers can further refine the time synchronization parameters.
Viewing time configuration for a virtualized domain controllers
For example, this is how the time settings look on our virtual domain controller. As you can see, it uses group policies to configure time settings and synchronize time with the external source pool.ntp.org.
However, if you check the current time source (w32tm /query /source), you can find it unexpectedly, because you can see a strange time source named VM IC Time Synchronization Provider.
The fact is that Hyper-V virtual machines synchronize their time with the host by default, and regardless of the settings of the time service inside the machine. As a result, it can turn out to be a rather strange situation when the Hyper-V host is a member of the domain and synchronizes time with the domain controller, which in turn is a virtual machine and synchronized with the host (Recursion?).
This behavior remains relevant for DCs running Windows Server 2022 and Windows Server 2025. Even with modern virtualization safeguards such as VM Generation ID, we recommend you to carefully control time sync sources for virtualized DCs.
In order to avoid this, you must disable time synchronization with the host for virtual domain controllers. There are two ways to do this.
Disable time synchronization in VM properties
The first way is to disable time synchronization in VM properties. To do this, open the properties of the virtual machine in the Hyper-V Manager snap-in, go to the Integration Services section and check off Time synchronization.
The same can be done using the PowerShell console on the Hyper-V server. For example, with this command, get the service status for the VM:
Get-VMIntegrationService -VMName dc1 -Name 'Time Synchronization'
Disable time synchronization
The following command will disable time synchronization:
Get-VMIntegrationService -VMName dc1 -Name 'Time Synchronization' | Disable-VMIntegrationService
Disable time synchronization with the host in VM settings
If you are using VMware ESXi as the virtualization host, you can disable the time synchronization with the host in the virtual machine settings.
VM> Edit Settings > VM Options tab > Check off Synchronize guest time with host.
Edit the registry to disable time synchronization
The second way is to edit the registry inside the guest virtual machine with ADDS role. To disable synchronization, run Regedit.exe, go to branch HKLM\ SYSTEM\ CurrentControlSet\ Services\ W32Time\ TimeProviders\ VMICTimeProvider and change the value for the Enabled parameter to 0.
Snapshots and Checkpoints Considerations
Modern versions of Hyper-V and VMware support VM Generation ID, and it makes snapshot restoring significantly safer than in legacy environments. However, you should not consider snapshots as a replacement for proper AD backups.
For production DCs, we recommend using system state backups and supported recovery procedures whenever possible.
Disable time synchronization via CMD
The same setting can be made from the Command Prompt by running the command:
reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider /v Enabled /t reg_dword /d 0 /f
Desirable settings
Depending on organizational requirements, you may choose to adjust MaxPosPhaseCorrection and MaxNegPhaseCorrection values. Note that these parameters should only be modified in environments that require strict control over time correction behavior. If you set them to 0xFFFFFFFF, it will remove correction limits, but note that it may not be appropriate in highly regulated environments where large time jumps must be prevented.
- Adjust the NTP polling interval if the server is configured to synchronize with manually specified NTP servers.
The SpecialPollInterval parameter is primarily used when W32Time is configured with manual peers (syncfromflags). Domain controllers using AD hierarchy mode (syncfromflags/NT5DS) do not rely on SpecialPollInterval. This parameter is only relevant when time sync is explicitly configured with manual NTP peers.reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient /v SpecialPollInterval /t reg_dword /d 900 /f
- Configure time correction limits (advanced).
MaxPosPhaseCorrection and MaxNegPhaseCorrection define the maximum amount of time correction that W32Time will accept automatically. The commonly documented default is 48 hours (172800 seconds), while our example below limits corrections to 1 hour (3600 seconds). This therefore makes the correction policy more restrictive, not less restrictive. However, these values are not universal best-practice settings and you should change them only when required by your organization’s time sync/security requirements.
Before changing them, check the effective config with the command:w32tm /query /configuration
If a one-hour correction limit is appropriate for your environment:reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config /v MaxNegPhaseCorrection /t reg_dword /d 3600 /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config /v MaxPosPhaseCorrection /t reg_dword /d 3600 /f
You should avoid setting these values to 0xFFFFFFFF as a general-purpose fix, because this effectively removes the correction limit and can allow very large time adjustments.
- After disabling synchronization by any of the described methods, it is necessary to restart the time service, this will reset it to a new source. On a domain controller with the PDC-emulator role, you must restart the w32time service and run the synchronization:
net stop w32time
net start w32time
w32tm /resync /force
On all other AD domain controllers, you need to additionally execute the command:
w32tm /config /syncfromflags:DOMHIER /update
This will cause the Time Service to select the PDC emulator as the source according to the domain hierarchy. In this way, we will configure the correct time synchronization scheme in the domain.
In general, you should avoid time config changes unless there is a clear sync issue. In properly configured AD environments, default time hierarchy behavior is sufficient and does not require additional tuning.
Time Synchronization Best Practices for Windows Server 2022 and 2025
The recommendations described above in this article apply to current Windows Server releases (including Windows Server 2022 and Windows Server 2025). Note that modern versions of AD continue to rely on a properly configured PDC emulator, authoritative NTP sources, and controlled virtualization time settings in order to maintain Kerberos authentication and replication consistency.
Checking Time Config
After reconfiguring time sync, you should check the active time source and current config. Use the following commands:
w32tm /query /source
w32tm /query /status
w32tm /query /configuration
w32tm /monitor
These commands help you to ensure that the PDC emulator is using the expected external NTP source and that other DCs are syncing according to the domain hierarchy.
When live troubleshooting, you can use w32tm /stripchart in order to monitor the time difference between the local computer and a specific DC/NTP server:
w32tm /stripchart /computer:DC01.contoso.com /samples:10 /dataonly
This displays multiple measurements of the time offset, which can help identify clock drift, an unstable time source, or an unexpectedly large offset.
You should use a specific DC/NTP server when troubleshooting a particular sync path.
Why is time configuration critical for virtualized domain controllers?
Time accuracy is essential for Active Directory because authentication (Kerberos), replication, and distributed services depend on consistent timestamps. Even small time drift can cause authentication failures, replication issues, and service instability in enterprise environments.
What is the correct time hierarchy in an Active Directory domain?
The recommended hierarchy is:
- PDC emulator synchronizes with external NTP sources
- All other domain controllers synchronize with the PDC emulator
- Member servers and workstations synchronize with the nearest domain controller
This hierarchy ensures consistent and authoritative time distribution across the domain.
Should virtual domain controllers synchronize time with the Hyper-V or VMware host?
No. Domain controllers should not rely on host-based time synchronization. Host integration time services can introduce conflicts or recursion scenarios in poorly configured environments. Time should be controlled via Active Directory hierarchy and a properly configured PDC emulator.
What is VM Generation ID and why is it important?
VM Generation ID is a virtualization feature that allows Active Directory to detect VM state changes such as snapshots, restores, or cloning. When a change is detected, AD protects against replication inconsistencies such as USN rollback. However, it does not replace proper time synchronization configuration.
What is Secure Time Seeding (STS) in Windows Server?
Secure Time Seeding is a Windows Time Service feature that helps systems recover from large time drift using secure network-derived timestamps. It is a supplementary mechanism and should not replace standard NTP-based time synchronization in Active Directory environments.
