Support for Windows Server 2003

ended on July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change
has affected your software updates and security options.Learn what this means
for you and how to stay protected.

INTRODUCTION
Windows Server includes W32Time, the Time Service tool that is required by the
Kerberos authentication protocol. The Windows Time service makes sure that all
computers in an organization that are running the Microsoft Windows 2000
Server operating system or later versions use a common time.
To guarantee appropriate common time usage, the Windows Time service uses a
hierarchical relationship that controls authority, and the Windows Time service
does not allow for loops. By default, Windows-based computers use the following
hierarchy:

All client desktop computers nominate the authenticating domain

controller as their in-bound time partner.

All member servers follow the same process that client desktop
computers follow.

All domain controllers in a domain nominate the primary domain controller

(PDC) operations master as their in-bound time partner.

All PDC operations masters follow the hierarchy of domains in the

selection of their in-bound time partner.
In this hierarchy, the PDC operations master at the root of the forest becomes
authoritative for the organization. We highly recommend that you configure the
authoritative time server to obtain the time from a hardware source. When you
configure the authoritative time server to sync with an Internet time source,
there is no authentication. We also recommend that you reduce your time
correction settings for your servers and stand-alone clients. These
recommendations provide more accuracy and security to your domain.

Configuring the Windows Time service to use an internal hardware

clock
To have us configure the Windows Time service to use an internal hardware
clock for you, go to the "Here's an easy fix" section. If you prefer to fix this
problem manually, go to the "Let me fix it myself" section.

Here's an easy fix

To fix this problem automatically, click the Download button. In the File
Download dialog box, click Run or Open, and then follow the steps in the easy
fix wizard.

This wizard may be in English only. However, the automatic fix also works
for other language versions of Windows.

If youre not on the computer that has the problem, save the easy fix
solution to a flash drive or a CD, and then run it on the computer that has the
problem.
Download

Let me fix it myself

Easy fix 50394
Important This section, method, or task contains steps that tell you how to
modify the registry. However, serious problems might occur if you modify the
registry incorrectly. Therefore, make sure that you follow these steps carefully.
For added protection, back up the registry before you modify it. Then, you can
restore the registry if a problem occurs. For more information about how to back
up and restore the registry, click the following article number to view the article
in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows

To configure the PDC master without using an external time source, change the
announce flag on the PDC master. The PDC master is the server that holds the
forest root PDC master role for the domain. This configuration forces the PDC
master to announce itself as a reliable time source and uses the built-in

complementary metal oxide semiconductor (CMOS) clock. To configure the PDC

master by using an internal hardware clock, follow these steps:
1.

Click Start, click Run, type regedit, and then click OK.

2.

Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\C
onfig\AnnounceFlags

3.

In the right-pane, right-click AnnounceFlags, and then click Modify.

4.

In Edit DWORD Value, type A in the Value data box, and then click OK.

5.

Close Registry Editor.

6.

At the command prompt, type the following command to restart the

Windows Time service, and then press Enter:
net stop w32time && net start w32time
Note The PDC master must not be configured to synchronize with itself. For
more information about why the PDC master must not be configured to
synchronize with itself, see Request For Comment (RFC) 1305.If the PDC master
is configured to synchronize with itself, the following events are logged in the
System log:
Event Type: Information
Event Source: W32Time
Event Category: None
Event ID: 38
Computer: ComputerName
Description: The time provider NtpClient cannot reach or is currently receiving
invalid time data from NTP_server_IP_Address. For more information, see Help
and Support Center at http://support.microsoft.com.
Event Type: Warning
Event Source: W32Time
Event Category: None
Event ID: 47
Computer: ComputerName
Description: Time Provider NtpClient: No valid response has been received from
manually configured peer NTP_server_IP_Address after 8 attempts to contact it.
This peer will be discarded as a time source and NtpClient will attempt to
discover a new peer with this DNS name. For more information, see Help and
Support Center at http://support.microsoft.com.

Event Type: Error

Event Source: W32Time
Event Category: None
Event ID: 29
Computer: ComputerName
Description: The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 15 minutes. NtpClient has no
source of accurate time. For more information, see Help and Support Center at
http://support.microsoft.com.
When the PDC master runs without using an external time source, the following
event is logged in the Application log:
Event Type: Error
Event Source: W32Time
Event Category: None
Event ID: 12
Description: Time Provider NtpClient: This machine is configured to use the
domain hierarchy to determine its time source, but it is the PDC emulator for the
domain at the root of the forest, so there is no machine above it in the domain
hierarchy to use as a time source. It is recommended that you either configure a
reliable time service in the root domain, or manually configure the PDC to
synchronize with an external time source. Otherwise, this machine will function
as the authoritative time source in the domain hierarchy. If an external time
source is not configured or used for this computer, you may choose to disable
the NtpClient.
This text is a reminder to use an external time source, and it can be ignored.

Configuring the Windows Time service to use an external time

source
To have us help you configure an internal time server to synchronize with an
external time source, go to the "Here's an easy fix" section. If you prefer to fix
this problem manually, go to the "Let me fix it myself" section.

Here's an easy fix

To fix this problem automatically, click the Download button. In the File
Download dialog box, click Run or Open, and then follow the steps in the easy
fix wizard.

When you run the Fix it to configure an external time source you will need
to specify the name of your NTP server. The Fix it will have the placeholder
names of Server1 and Server2. Replace these placeholder names with the name
of your NTP server followed by ,0x1. i.e SRV1.Contoso.com,0x1. You do not
have to specify more than one server but it is recommended to do so for
redundancy. If you have multiple entries they must be separated by a space.

The unit of time

for SpecialPollInterval,MaxPosPhaseCorrectionand MaxNegPhaseCorrection settin
gs is in seconds.

This wizard may be in English only. However, the automatic fix also works
for other language versions of Windows.

If youre not on the computer that has the problem, save the easy fix
solution to a flash drive or a CD, and then run it on the computer that has the
problem.
Download

Let me fix it myself

Easy fix 50395
To configure an internal time server to synchronize with an external time source,
follow these steps:
1.

Change the server type to NTP. To do this, follow these steps:

a.

Click Start, click Run, type regedit, and then click OK.

b.

Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\P
arameters\Type

c.

In the pane on the right, right-click Type, and then click Modify.

d.

In Edit Value, type NTP in the Value data box, and then click OK.

2.
a.

Set AnnounceFlags to 5. To do this, follow these steps:

Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\C
onfig\AnnounceFlags
b.

In the pane on the right, right-click AnnounceFlags, and then

click Modify.

c.

In Edit DWORD Value, type 5 in the Value data box, and then
click OK.
Notes

If an authoritative time server that is configured to use an

AnnounceFlag value of 0x5 does not synchronize with an upstream time server,
a client server may not correctly synchronize with the authoritative time server
when the time synchronization between the authoritative time server and the
upstream time server resumes. Therefore, if you have a poor network
connection or other concerns that may cause time synchronization failure of the
authoritative server to an upstream server, set the AnnounceFlag value to 0xA
instead of to 0x5.

If an authoritative time server that is configured to use an

AnnounceFlag value of 0x5 and to synchronize with an upstream time server at
a fixed interval that is specified in SpecialPollInterval, a client server may not
correctly synchronize with the authoritative time server after the authoritative
time server restarts. Therefore, if you configure your authoritative time server to
synchronize with an upstream NTP server at a fixed interval that is specified in
SpecialPollInterval, set the AnnounceFlag value to 0xA instead of 0x5.

3.

Enable NTPServer. To do this, follow these steps:

a.

Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Ti
meProviders\NtpServer

b.

In the pane on the right, right-click Enabled, and then

click Modify.

c.

In Edit DWORD Value, type 1 in the Value data box, and then
click OK.

4.

Specify the time sources. To do this, follow these steps:

a.

Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\P
arameters

b.

In the pane on the right, right-click NtpServer, and then

click Modify.

c.

In Edit Value, type Peers in the Value data box, and then
click OK.
Note Peers is a placeholder for a space-delimited list of peers from which
your computer obtains time stamps. Each DNS name that is listed must be
unique. You must append ,0x1 to the end of each DNS name. If you do not
append ,0x1 to the end of each DNS name, the changes that you make in step 5
will not take effect.

5.
a.

Select the poll interval. To do this, follow these steps:

Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Ti
meProviders\NtpClient\SpecialPollInterval

b.

In the pane on the right, right-click SpecialPollInterval, and then

click Modify.

c.

In Edit DWORD Value, type TimeInSeconds in the Value data box,

and then click OK.
Note TimeInSeconds is a placeholder for the number of seconds that you
want between each poll. A recommended value is 900 (decimal). This value
configures the Time Server to poll every 15 minutes.

6.
a.

Configure the time correction settings. To do this, follow these steps:

Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\C
onfig\MaxPosPhaseCorrection

b.

In the pane on the right, right-click MaxPosPhaseCorrection, and

then click Modify.

c.
d.

In Edit DWORD Value, click to select Decimal in the Base box.

In Edit DWORD Value, type TimeInSeconds in the Value data box,
and then click OK.
Note

TimeInSeconds is a placeholder for a reasonable value, such

as 1 hour (3600) or 30 minutes (1800). The value that you select will depend on
the poll interval, network condition, and external time source.

The default value of MaxPosPhaseCorrection is 48 hours in

Windows Server 2008 R2 or later.

e.

Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\C
onfig\MaxNegPhaseCorrection

f.

In the pane on the right, right-click MaxNegPhaseCorrection, and

then click Modify.

g.
h.

In Edit DWORD Value, click to select Decimal in the Base box.

In Edit DWORD Value, type TimeInSeconds in the Value data box,
and then click OK.
Note

TimeInSeconds is a placeholder for a reasonable value, such

as 1 hour (3600) or 30 minutes (1800). The value that you select will depend on
the poll interval, network condition, and external time source.

The default value of MaxNegPhaseCorrection is 48 hours in

Windows Server 2008 R2 or later.

7.
8.

Close Registry Editor.

At the command prompt, type the following command to restart the
Windows Time service, and then press Enter:
net stop w32time && net start w32time

Note For a list of available time servers, see Microsoft Knowledge Base
article 262680: A list of the Simple Network Time Protocol (SNTP) time servers
that are available on the Internet

Troubleshooting
For the Windows Time service to function correctly, the networking
infrastructure must function correctly. The most common problems that affect
the Windows Time service include the following:

There is a problem with TCP/IP connectivity, such as a dead gateway.

The Name Resolution service is not working correctly.

The network is experiencing high volume delays, especially when

synchronization occurs over high-latency wide area network (WAN) links.

The Windows Time service is trying to synchronize with inaccurate time

sources.
We recommend that you use the Netdiag.exe utility to troubleshoot networkrelated issues. Netdiag.exe is part of the Windows Server 2003 Support Tools
package. See Tools Help for a complete list of command-line parameters that
you can use with Netdiag.exe. If your problem is still not solved, you can turn on
the Windows Time service debug log. Because the debug log can contain very
detailed information, we recommend that you contact Microsoft Customer
Support Services when you turn on the Windows Time service debug log.
For a complete list of Microsoft Customer Support Services telephone numbers
and information about support costs, go to the Contact Microsoft website.
Note In special cases, charges that are ordinarily incurred for support calls
may be canceled if a Microsoft Support Professional determines that a specific
update will resolve your problem. The usual support costs will apply to additional
support questions and issues that do not qualify for the specific update in
question. WAZOO.

References
For more information about Windows Time service, see the following Microsoft
Knowledge Base articles:

816043: How to turn on debug logging in the Windows Time service

884776: Configuring the Windows Time service against a large time offset

321708: How to use the Network Diagnostics Tool (Netdiag.exe) in

Windows 2000

314054: How to configure an authoritative time server in Windows XP

216734: How to configure an authoritative time server in Windows 2000

For more information about the Windows Time service, see Windows Time
Service Technical Reference.

Properties
Article ID: 816042 - Last Review: 09/25/2015 08:54:00 - Revision: 21.0
Applies to

Windows Server 2012 Standard

Windows Server 2012 Essentials

Windows Server 2008 R2 Standard

Windows Server 2008 R2 Datacenter

Windows Server 2008 R2 Enterprise

Windows Server 2008 Standard

Windows Server 2008 Enterprise

Windows Server 2008 Datacenter

Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)

Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)

Microsoft Windows Server 2003, Standard Edition (32-bit x86)

Microsoft Windows Server 2003, Web Edition

Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based

Systems

Microsoft Windows Server 2003, Enterprise Edition for Itanium-based

Systems

Windows Server 2008 R2 Service Pack 1

Keywords:

kbfixme kbmsifixme kbsecurity kbhowto KB816042