The behavior described matches known Windows time issues where devices can drift by hours or even a full day, and the problem returns even after manual sync or reimage. Two areas are especially relevant:
- Secure Time Seeding causing rollbacks
- Time zone/DST configuration problems
On Surface Go devices joined to a network, incorrect time can break authentication and access to resources (including test platforms), so the goal is to remove the root causes, not just resync.
Actionable steps to fix it more permanently:
- Verify time zone and DST configuration
- On each Surface Go, go to Settings > Time & language.
- Confirm the correct time zone for Eastern Time is selected.
- Ensure any DST settings are correct for the region.
- Misconfigured time zone or DST can cause the clock to be off by one hour or more, and in some cases by a day when crossing midnight boundaries.
- Address Secure Time Seeding–related rollbacks
- Windows has a Secure Time Seeding feature in the Windows Time service that uses metadata from outbound SSL connections to estimate time.
- If devices are restarted on networks with no outbound SSL traffic (for example, closed private networks in exam rooms), Windows can reuse stale Secure Time Seeding data stored in the registry and roll the clock back by at least one day.
- This can override administrator-set time and cause:
- Event log entries with timestamps in the past
- Kerberos authentication failures
- Students being unable to access time‑sensitive content
- To mitigate this in an enterprise/education environment:
- Ensure devices can reach a reliable NTP source (for example, domain hierarchy or a dedicated NTP server) when they start up.
- Avoid scenarios where devices boot only on closed networks with no SSL and no time source.
- In managed environments, consider centrally configuring Windows Time service to rely on your AD DS hierarchy or a specific NTP server and review Secure Time Seeding behavior as part of your standard image or GPO configuration.
- Watch for large time rollbacks and their side effects
- Large time jumps (hours or days) can cause:
- Password and trust relationship issues
- Replication problems in AD environments
- If devices are observed to roll forward or backward significantly, review time service configuration and event logs (for example, Kernel‑General event ID 1) to confirm when and how the time is changing, then standardize configuration across all Surface Go devices.
- Standardize and test on a reference device
- Take one Surface Go, configure:
- Correct time zone/DST
- Reliable NTP source (domain or dedicated NTP server)
- Network conditions that match exam rooms (including any closed networks)
- Reboot multiple times and verify that the time remains correct without manual sync.
- Once stable, replicate the same configuration (via imaging, Intune, or Group Policy) to all devices.
These steps move beyond one‑off manual syncs and target the underlying Windows time mechanisms that can cause recurring drift or rollbacks, which is critical in a testing environment.
References: