2

I'm having a problem with W32Time service on Windows Server 2019 not respecting the default limit on positive time offsets (MaxPosPhaseCorrection/MaxNegPhaseCorrection = 15 days). The server is running on AWS as non-domain joined and the time service is configured to use the Amazon Time Synchronization service.

Sometimes Amazon's service returns invalid data for synchronization, weeks or even a month off the actual value. W32Time reports the large difference in the Event Log as a warning and still shifts server time beyond the limit. Then after a couple of hours it restores server time to the normal value.

Any advice on how to control this behavior?

Greg Askew
  • 35,880
  • 5
  • 54
  • 82
kirill_l
  • 237
  • 3
  • 11

1 Answers1

2

This may be due to a feature in Windows Server 2016+. When time sync is temporarily unavailable, use the time stamp from TLS packets. Unfortunately, sometimes the timestamp has random data inserted by other applications for other purposes, and it should not be relied upon.

Secure Time Seeding

This feature determines the approximate current time from outgoing SSL connections. This time value is used to monitor the local system clock and correct any gross errors. In deployments with a reliable time source(s) and well monitored machines that include monitoring for time offsets, you may choose to not use the Secure Time Seeding feature and rely on your existing infrastructure instead.

You can disable the feature with these steps:

Set the UtilizeSSLTimeData registry value to 0:

reg add HKLM\SYSTEM\CurrentControlSet\Services\w32time\Config /v UtilizeSslTimeData /t REG_DWORD /d 0 /f

If you are unable to reboot the machine immediately due to some reason, you can notify W32time service about the configuration update. This stops time monitoring and enforcement based on time data collected from SSL connections.

W32tm.exe /config /update

https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-server-2016-improvements

https://learn.microsoft.com/en-us/archive/blogs/w32time/secure-time-seeding-improving-time-keeping-in-windows

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/turn-on-debug-logging-in-windows-time-service

Greg Askew
  • 35,880
  • 5
  • 54
  • 82