Time Sync issues on Windows 10 domain joined machines

Question

I have started with new issue in my environment with time sync. Most of the users have now started working from home and hardly connecting to corporate network either directly or over VPN due to some challenges at network end. 

Further Details:

Operating System - Window 10 1709

Type - Domain Joined

The issues generally starts after 4-5 days and user notice time difference of 5-7 minutes. To fix it, I either need to connect machine to VPN and run GPO forcefully or change setting (mentioned below) to sync time with time.windows.com.

Settings-> Time & Language ->Related Settings ->Addition date, time, & regional settings -> Clock and Region -> Date and Time -> Change Settings. Then enabled Synchronise with and Internet time server as time.windows.com.

The above settings hardcodes machine to sync over internet and changes the registry settings(Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\Type - NTP) to NTP which is not recommended for domain joined computers. The domain joined devices is having NT5DS settings which is for domain joined computer.

So is there any way like when devices are connected to corp network, it sync time with local domain controller and when not, it starts synching with internet time server?

Thanks

Dinesh Kashyap

Answer 1

Hello,

Is there any further resolution to this issue? We are experiencing the same thing with domain joined PCs, mostly Windows 10 laptops, and so far nothing I've tried has helped. People that are admins of their own PC are able to go into settings and click the 'sync' now button but non-admins have that grayed out. Any other thought on this are greatly appreciated. Thanks.

Jon

Answer 2

Hello,

Is there any further resolution to this issue? We are experiencing the same thing with domain joined PCs, mostly Windows 10 laptops, and so far nothing I've tried has helped. People that are admins of their own PC are able to go into settings and click the 'sync' now button but non-admins have that grayed out. Any other thought on this are greatly appreciated. Thanks.

Jon

Hi Jon,

In most of the cases in Windows 10 it happens  because of a feature called "Secure Time Seeding". You can can click here to know about this feature. In order to verify this please follow below steps:

1. Run the below command in CMD (run as administrator) to disable this feature on one of the machine and observe:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\Config /v UtilizeSslTimeData /t REG_DWORD /d 0 /f

2. In case if you still face the issue then please run below commands in CMD (run as administrator) in two scenarios (when you face the issue and when time is correct) on the problematic machine and send me the output.

w32tm /query /peers

w32tm /query /status

Regards:

Sachin Kumar

TechNet Profile

Answer 3

Hi Dinesh, Please open event viewer and check the event id "4616" in the "Security" event logs on the problematic system and see the description of the event to know what changed the time system (as mentioned in the below example):

Process Information:

Process ID: 0x7d4

Name: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe

Previous Time: ?2019?-?10?-?23T16:17:46.771885000Z

New Time: ?2019?-?10?-?23T17:58:42.497000000Z

NOTE: In the above example time was changed because of VMWare tools.

Regards:

Sachin Kumar

TechNet Profile

Email id: *** Email address is removed for privacy ***

Hi Sachin Kumar,

If the issue is being caused by Secure Time Seeding feature, would i still be able to find event 4616 in the event viewer on a machine that is having this issue? If so, what should i expect to see as the process that changed the time as in your example above?

Any input is appreciated.

Thank you,

Jose

Hi Jose,

Yes, you will still see the event id 4616 and process would be Windows Time Service (W32Time).

Regards:

Sachin Kumar

TechNet Profile

Answer 4

Hi Dinesh, Please open event viewer and check the event id "4616" in the "Security" event logs on the problematic system and see the description of the event to know what changed the time system (as mentioned in the below example):

Process Information:

Process ID: 0x7d4

Name: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe

Previous Time: ?2019?-?10?-?23T16:17:46.771885000Z

New Time: ?2019?-?10?-?23T17:58:42.497000000Z

NOTE: In the above example time was changed because of VMWare tools.

Regards:

Sachin Kumar

TechNet Profile

Email id: ******@hotmail.com

Answer 5

Sachin,

Thanks for the reply. I tried your suggestion and it worked on a test machine. Quick question, when the user brings the laptop back to the office (after all the Covid-19 work-from-home stuff eventually ends), it looks like from I read that it would go back to syncing time with the domain controller, is this the case?

Jon