EventID 4: Time provider 'NtpClient' failed to start

Question

Hi,

I have a Windows Server 2016 DC with PDC role. Its a Hyper-V VM with time synchronisation disabled.

For some time now, the NtpClient doesn't synchronise to a global time server. I can't change the source from "Local CMOS Clock" to a global time server. 

In the event viewer I see an error from the time service with event ID 4:

• <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> 
• <System> 

<Provider Name="Microsoft-Windows-Time-Service" Guid="{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}" /> 

<EventID>4</EventID> 

<Version>0</Version> 

<Level>2</Level> 

<Task>0</Task> 

<Opcode>0</Opcode> 

<Keywords>0x8000000000000000</Keywords> 

<TimeCreated SystemTime="2023-10-11T07:01:57.361751700Z" /> 

<EventRecordID>774899</EventRecordID> 

<Correlation /> 

<Execution ProcessID="852" ThreadID="8768" /> 

<Channel>System</Channel> 

<Computer>FQDN</Computer> 

<Security UserID="S-1-5-19" /> 

</System> 

• <EventData Name="TMP_EVENT_TIMEPROV_FAILED_START"> 

<Data Name="TimeProvider">NtpClient</Data> 

<Data Name="ErrorMessage">Die Konfigurationsdaten für dieses Produkt sind beschädigt. Wenden Sie sich an den Support. (0x8007064A)</Data> 

</EventData> 

</Event>

I enable logging and Log says this:

154415 07:01:57.3440666s - ---------- Log File Opened -----------------

154415 07:01:57.3443223s - CurSpc:15625000ns  BaseSpc:15625000ns  SyncToCmos:Yes

154415 07:01:57.3443458s - PowerNotificationCallback: Data:0 SuspendState:0

154415 07:01:57.3443534s - PerfFreq:10000000c/s

154415 07:01:57.3443984s - PowerNotificationCallback: Ignoring resume notification since we never entered suspend state.

154415 07:01:57.3445490s - ReadConfig: Found provider 'NtpClient':

154415 07:01:57.3446002s - ReadConfig:   'Enabled'=0x00000001

154415 07:01:57.3446272s - ReadConfig:   'DllName'='C:\Windows\SYSTEM32\w32time.DLL'

154415 07:01:57.3446446s - ReadConfig:   'DllName'='C:\Windows\SYSTEM32\w32time.DLL'

154415 07:01:57.3446779s - ReadConfig:   'DllName'='C:\Windows\SYSTEM32\w32time.DLL'

154415 07:01:57.3446978s - ReadConfig:   'InputProvider'=0x00000001

154415 07:01:57.3447233s - ReadConfig: Found provider 'NtpServer':

154415 07:01:57.3447733s - ReadConfig:   'Enabled'=0x00000001

154415 07:01:57.3447959s - ReadConfig:   'DllName'='C:\Windows\SYSTEM32\w32time.DLL'

154415 07:01:57.3448126s - ReadConfig:   'DllName'='C:\Windows\SYSTEM32\w32time.DLL'

154415 07:01:57.3448287s - ReadConfig:   'DllName'='C:\Windows\SYSTEM32\w32time.DLL'

154415 07:01:57.3448474s - ReadConfig:   'InputProvider'=0x00000000

154415 07:01:57.3448700s - ReadConfig: Found provider 'VMICTimeProvider':

154415 07:01:57.3449028s - ReadConfig:   'Enabled'=0x00000001

154415 07:01:57.3449257s - ReadConfig:   'DllName'='C:\Windows\System32\vmictimeprovider.dll'

154415 07:01:57.3449430s - ReadConfig:   'DllName'='C:\Windows\System32\vmictimeprovider.dll'

154415 07:01:57.3449591s - ReadConfig:   'DllName'='C:\Windows\System32\vmictimeprovider.dll'

154415 07:01:57.3449934s - ReadConfig:   'InputProvider'=0x00000001

154415 07:01:57.3450739s - ReadConfig (policy): Found provider 'NtpClient':

154415 07:01:57.3452168s - ReadConfig: 'PhaseCorrectRate'=0x00000007 (2)

154415 07:01:57.3452429s - ReadConfig: 'UpdateInterval'=0x00000064 (2)

154415 07:01:57.3453302s - ReadConfig: 'FrequencyCorrectRate'=0x00000004 (2)

154415 07:01:57.3453569s - ReadConfig: 'PollAdjustFactor'=0x00000005 (2)

154415 07:01:57.3453764s - ReadConfig: 'LargePhaseOffset'=0x02FAF080 (2)

154415 07:01:57.3453955s - ReadConfig: 'SpikeWatchPeriod'=0x00000384 (2)

154415 07:01:57.3454138s - ReadConfig: 'HoldPeriod'=0x00000005 (2)

154415 07:01:57.3454324s - ReadConfig: 'MinPollInterval'=0x00000006 (2)

154415 07:01:57.3454510s - ReadConfig: 'MaxPollInterval'=0x0000000A (2)

154415 07:01:57.3454701s - ReadConfig: 'AnnounceFlags'=0x00000005 (2)

154415 07:01:57.3454888s - ReadConfig: 'LocalClockDispersion'=0x0000000A (2)

154415 07:01:57.3455079s - ReadConfig: 'MaxNegPhaseCorrection'=0x00000E10 (2)

154415 07:01:57.3455269s - ReadConfig: 'MaxPosPhaseCorrection'=0x00000E10 (2)

154415 07:01:57.3455455s - ReadConfig: 'EventLogFlags'=0x00000002 (2)

154415 07:01:57.3455644s - ReadConfig: 'MaxAllowedPhaseOffset'=0x0000012C (2)

154415 07:01:57.3455830s - ReadConfig: 'UtilizeSslTimeData'=0x00000001 (2)

154415 07:01:57.3456017s - ReadConfig: 'TimeJumpAuditOffset'=0x00007080 (2)

154415 07:01:57.3456398s - lastClockRate=156250, clockPrecision=-6

154415 07:01:57.3456965s - SetTimeSlipNotification succeeds with 0x00000000.

154415 07:01:57.3458343s - W32TmServiceMain: RequestNetTopoChangeNotification Succeed

154415 07:01:57.3458927s - W32TmServiceMain: RequestNetTopoChangeNotification Succeed

154415 07:01:57.3475182s -   DomainHierarchy: LSA role change notification. Redetecting.

154415 07:01:57.3547186s - ClockDisciplineThread: Starting: SetUnsync: LI:0 S:1 RDl:0 RDs:100000000 TSF:0x0 

154415 07:01:57.3560834s - ClockDispln: we're a reliable time service with no time source: LS: 0, TN: 864000000000, WAIT: 86400000

154415 07:01:57.3562078s - Starting Providers.

154415 07:01:57.3562541s - Starting 'NtpClient', dll:'C:\Windows\SYSTEM32\w32time.DLL'

154415 07:01:57.3562883s - LoadLibrary

154415 07:01:57.3563165s - NtpTimeProvOpen("NtpClient") called.

154415 07:01:57.3563347s - StartNtpProv

154415 07:01:57.3564468s - sysPrecision=-6, systmeClockResolution=156250

154415 07:01:57.3570213s - NtpProvider: Created 2 sockets (0 listen-only): [::]:123<0x0>, 0.0.0.0:123<0x0>

154415 07:01:57.3570754s - StartListeningThread completed!

154415 07:01:57.3571022s - PeerPollingThread: waiting forever

154415 07:01:57.3571431s - StartPeerPollingThread completed!

154415 07:01:57.3573224s - ReadConfig: 'AllowNonstandardModeCombinations'=0x00000001 (2)

154415 07:01:57.3574081s - ReadConfig: 'CompatibilityFlags'=0x80000000 (2)

154415 07:01:57.3574409s - ReadConfig: 'SpecialPollInterval'=0x00000400 (3)

154415 07:01:57.3574791s - ReadConfig: 'ResolvePeerBackoffMinutes'=0x0000000F (3)

154415 07:01:57.3575029s - ReadConfig: 'ResolvePeerBackoffMaxTimes'=0x00000007 (3)

154415 07:01:57.3575234s - ReadConfig: 'EventLogFlags'=0x00000000 (3)

154415 07:01:57.3575467s - ReadConfig: 'LargeSampleSkew'=0x00000003 (2)

154415 07:01:57.3576500s - ReadConfig: 'SignatureAuthAllowed'=0x00000001 (2)

154415 07:01:57.3576867s - ReadConfig: 'Type'=NTP (3)

154415 07:01:57.3577192s - ReadConfig: 'NtpServer'=ntp1.zih.tu-dresden.de, 0x1 ntp2.zih.tu-dresden.de, 0x1 ptbtime3.ptb.de, 0x1 ptbtime4.ptb.de, 0x1 3.de.pool.ntp.org, 0x1 (3)

154415 07:01:57.3577506s - ReadConfig: 'ManualPeerList'(parsed)='ntp1.zih.tu-dresden.de,', '0x1', 'ntp2.zih.tu-dresden.de,', '0x1', 'ptbtime3.ptb.de,', '0x1', 'ptbtime4.ptb.de,', '0x1', '3.de.pool.ntp.org,', '0x1'

154415 07:01:57.3577852s - NTP client telemetry enabled: 0

154415 07:01:57.3586346s - StartListeningThread completed!

154415 07:01:57.3587540s - PeerPollingThread: waiting forever

154415 07:01:57.3588200s - StartPeerPollingThread completed!

154415 07:01:57.3588375s - PeerPollingThread: PeerListUpdated

154415 07:01:57.3588419s - StopNtpProv

154415 07:01:57.3588847s - PeerPollingThread: waiting forever

154415 07:01:57.3589575s - ListeningThread: StopEvent

154415 07:01:57.3589875s - PeerPollingThread: StopEvent

154415 07:01:57.3616909s - Logging error: Time provider 'NtpClient' failed to start due to the following error: Die Konfigurationsdaten für dieses Produkt sind beschädigt. Wenden Sie sich an den Support. (0x8007064A)

154415 07:01:57.3617572s - Discarding provider 'NtpClient'.

154415 07:01:57.3617897s - RemoveProviderFromList: NtpClient

154415 07:01:57.3618104s - Starting 'NtpServer', dll:'C:\Windows\SYSTEM32\w32time.DLL'

154415 07:01:57.3618384s - LoadLibrary

154415 07:01:57.3618591s - NtpTimeProvOpen("NtpServer") called.

154415 07:01:57.3618760s - StartNtpProv

154415 07:01:57.3618941s - sysPrecision=-6, systmeClockResolution=156250

154415 07:01:57.3624497s - NtpProvider: Created 2 sockets (0 listen-only): [::]:123<0x0>, 0.0.0.0:123<0x0>

154415 07:01:57.3625004s - StartListeningThread completed!

154415 07:01:57.3625217s - PeerPollingThread: waiting forever

154415 07:01:57.3625445s - StartPeerPollingThread completed!

154415 07:01:57.3626448s - ReadConfig: 'AllowNonstandardModeCombinations'=0x00000001 (2)

154415 07:01:57.3626888s - ReadConfig: 'EventLogFlags'=0x00000000 (0)

154415 07:01:57.3627117s - ReadConfig: 'UnsecureTimeSyncRequestsLogThrottlePeriod'=0x05265C00 (86400000)

154415 07:01:57.3627542s - ReadConfig: failed to open 'Software\Policies\Microsoft\W32Time\Config' key, treating as non-fatal

154415 07:01:57.3627783s - ReadConfig: 'RequireSecureTimeSyncRequests'=0x00000000 (2)

154415 07:01:57.3628121s - StartListeningThread completed!

154415 07:01:57.3628309s - PeerPollingThread: waiting forever

154415 07:01:57.3628514s - StartPeerPollingThread completed!

154415 07:01:57.3628679s - NtpServer started.

154415 07:01:57.3628842s - Logging Info: Time provider 'NtpServer' has started successfully

154415 07:01:57.3629006s - Starting 'VMICTimeProvider', dll:'C:\Windows\System32\vmictimeprovider.dll'

154415 07:01:57.4031758s - LoadLibrary

154415 07:01:57.4035071s - Logging Info: Time provider 'VMICTimeProvider' has started successfully

154415 07:01:57.4035565s - Successfully started 2 providers.

154415 07:01:57.4045407s - W32TmServiceMain: waiting i16.000s (64.000s)

154415 07:01:57.4049880s - W32TmServiceMain: Network Topology Change

154415 07:01:57.4050510s - TimeProvCommand([NtpServer], TPC_NetTopoChange) called.

154415 07:01:57.4050561s - W32TmServiceMain: Network Topology Change

154415 07:01:57.4050915s - NtpProvider: Network Topology Change

154415 07:01:57.4051189s - TimeProvCommand([NtpServer], TPC_NetTopoChange) called.

154415 07:01:57.4052242s -   Peers reset: p-p:0 a-p:0 a-x:0

154415 07:01:57.4055764s - NtpProvider: Created 2 sockets (0 listen-only): [::]:123<0x0>, 0.0.0.0:123<0x0>

154415 07:01:57.4056641s - StartListeningThread completed!

154415 07:01:57.4056968s - PeerPollingThread: waiting forever

154415 07:01:57.4057264s - StartPeerPollingThread completed!

154415 07:01:57.4057437s - PeerPollingThread: PeerListUpdated

154415 07:01:57.4057522s - W32TmServiceMain: waiting i15.999s (63.999s)

154415 07:01:57.4058188s - PeerPollingThread: waiting forever

154415 07:01:57.4058795s - W32TmServiceMain: RequestNetTopoChangeNotification Succeed

154415 07:01:57.4060401s - NtpProvider: Network Topology Change

154415 07:01:57.4061733s -   Peers reset: p-p:0 a-p:0 a-x:0

154415 07:01:57.4064701s - NtpProvider: Created 2 sockets (0 listen-only): [::]:123<0x0>, 0.0.0.0:123<0x0>

154415 07:01:57.4065143s - StartListeningThread completed!

154415 07:01:57.4065338s - PeerPollingThread: waiting forever

154415 07:01:57.4065603s - StartPeerPollingThread completed!

154415 07:01:57.4065972s - W32TmServiceMain: waiting i15.999s (63.999s)

154415 07:01:57.4066081s - PeerPollingThread: PeerListUpdated

154415 07:01:57.4066429s - W32TmServiceMain: RequestNetTopoChangeNotification Succeed

154415 07:01:57.4066719s - PeerPollingThread: waiting forever

154415 07:01:59.3101528s - W32TimeHandler called: SERVICE_CONTROL_INTERROGATE

154415 07:02:13.3984523s - W32TmServiceMain: timeout

154415 07:02:13.3985253s - W32TmServiceMain: waiting 64.000s

C:\Windows\system32>w32tm /query /status

Sprungindikator: 0(keine Warnung)

Stratum: 1 (Primärreferenz - synchron. über Funkuhr)

Präzision: -6 (15.625ms pro Tick)

Stammverzögerung: 0.0000000s

Stammabweichung: 10.0000000s

Referenz-ID: 0x4C4F434C (Quellname:  "LOCL")

Letzte erfolgr. Synchronisierungszeit: 11.10.2023 09:01:57

Quelle: Local CMOS Clock

Abrufintervall: 6 (64s)

C:\Windows\system32>w32tm /query /configuration

[Konfiguration]

EventLogFlags: 2 (Lokal)

AnnounceFlags: 5 (Lokal)

TimeJumpAuditOffset: 28800 (Lokal)

MinPollInterval: 6 (Lokal)

MaxPollInterval: 10 (Lokal)

MaxNegPhaseCorrection: 3600 (Lokal)

MaxPosPhaseCorrection: 3600 (Lokal)

MaxAllowedPhaseOffset: 300 (Lokal)

FrequencyCorrectRate: 4 (Lokal)

PollAdjustFactor: 5 (Lokal)

LargePhaseOffset: 50000000 (Lokal)

SpikeWatchPeriod: 900 (Lokal)

LocalClockDispersion: 10 (Lokal)

HoldPeriod: 5 (Lokal)

PhaseCorrectRate: 7 (Lokal)

UpdateInterval: 100 (Lokal)

FileLogName: c:\W32Time\w32time.log (Lokal)

FileLogEntries: 0-116 (Lokal)

FileLogSize: 10000000 (Lokal)

[Zeitanbieter]

NtpServer (Lokal)

DllName: C:\Windows\SYSTEM32\w32time.DLL (Lokal)

Enabled: 1 (Lokal)

InputProvider: 0 (Lokal)

AllowNonstandardModeCombinations: 1 (Lokal)

VMICTimeProvider (Lokal)

DllName: C:\Windows\System32\vmictimeprovider.dll (Lokal)

Enabled: 1 (Lokal)

InputProvider: 1 (Lokal)

C:\Windows\system32>w32tm /query /peers

Folgender Fehler ist aufgetreten: Element nicht gefunden. (0x80070490)

C:\Windows\system32>w32tm /dumpreg /subkey:config

Wertname                  Werttyp             Wertdaten

---

FrequencyCorrectRate      REG_DWORD           4

PollAdjustFactor          REG_DWORD           5

LargePhaseOffset          REG_DWORD           50000000

SpikeWatchPeriod          REG_DWORD           900

HoldPeriod                REG_DWORD           5

LocalClockDispersion      REG_DWORD           10

EventLogFlags             REG_DWORD           2

TimeJumpAuditOffset       REG_DWORD           28800

UtilizeSslTimeData        REG_DWORD           1

LastKnownGoodTime         <UNBEKANNTER REG.-TYP><N. ANALYSIERBARE REG.-DATEN>

PhaseCorrectRate          REG_DWORD           7

MinPollInterval           REG_DWORD           6

MaxPollInterval           REG_DWORD           10

MaxNegPhaseCorrection     REG_DWORD           3600

MaxPosPhaseCorrection     REG_DWORD           3600

UpdateInterval            REG_DWORD           100

AnnounceFlags             REG_DWORD           5

MaxAllowedPhaseOffset     REG_DWORD           300

FileLogName               REG_SZ              c:\W32Time\w32time.log

FileLogEntries            REG_SZ              0-116

FileLogSize               REG_DWORD           10000000

What I have already tried:

• Set the Source

w32tm /config /syncfromflags:manual /manualpeerlist:"0.de.pool.ntp.org, 1.de.pool.ntp.org, ptbtime1.ptb.de, ptbtime2.ptb.de"

w32tm /config /reliable:yes /update

w32tm /resync

w32tm /query /source

Local CMOS Clock

The source is still the same.

• Reset the Time-Service

net stop w32time

w32tm /unregister

w32tm /register

net start w32time

w32tm /resync

Do someone have any idea how to solve this problem?

Answer 1

Hello TobiGLH,

Thank you for posting in Microsoft Community forum.

Did the issue occur suddenly? If so, have you made any change in your AD domain?

Or you build the PDC just now and try to configure the time sync on PDC?

You can try to configure the registry setting on PDC.

Because the PDC is a virtual machine, this first registry needs to be set.

HLM\SYSTEM\CurrentControlSet\services\w32time\TimeProviders\VMICTimeProvider

Name: Enabled

Type: REG_DWORD

Data:0

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config

Key Name: AnnounceFlags

Type: REG_DWORD (DWORD Value)

Data: 0x5

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type

Key Name: Type

Type: REG_SZ(String Value)

Data: NTP

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

Key Name: NtpServer

Type: REG_SZ(String Value)

Data: Peers（time.windows.com,0x9）

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer

Key Name: Enabled

Type: REG_DWORD

Data: 1

Check UDP 123 port. The Windows Time service follows the Network Time Protocol (NTP) specification, which requires the use of UDP port 123 for all time synchronization. Whenever the computer synchronizes its clock or provides time to another computer, it happens over UDP port 123. 

Once done, restart W32Time service on PDC.

Note: Please back up the registry on PDC before you make any change on registry.

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 2

Thank you @Daisy Zhou123 for your suggested solution.

I fixed the problem myself.

I found an incorrectly configured GPO.

After I changed the GPO, everything worked fine.

Best regards,

TobiGLH

Answer 3

Hello TobiGLH,

Thank you for your update. I am so glad that the issue was resolved.

It would be perfect if you were willing to share the solution here.

Thank you again!

Best Regards,
Daisy Zhou