Windows Time Service settings aren’t preserved during an in-place upgrade to Windows Server 2016 or Windows 10 Version 1607

This article describes an issue in which Windows Time service settings are disabled in the registry after you upgrade to Windows Server 2016 or Windows 10 Version 1607.

Original product version: В Windows Server 2016, Windows Server 2012 R2, Windows 10 — all editions
Original KB number: В 3201265

Symptoms

When you do an in-place upgrade on the following operating systems upgrade paths, the Windows Time service doesn’t preserve its configuration. Instead, it shows the default values for a workgroup server or workstation.

Upgrade from	Upgrade to
Windows Server 2012 or Windows Server 2012 R2	Windows Server 2016
Windows 7, Windows 8, or Windows 8.1	Windows 10 Version 1607

Affected roles

After the in-place upgrade is completed, the following roles may be affected.

Domain controllers

The domain controllers (DC) that hosts the PDC emulator role is the default authoritative time server for the domain. Typically, it’s configured to sync with a highly accurate time source. All other DCs in the domain sync their time with the PDC.

After you do an in-place upgrade, the PDC loses its connection to the external time server that it’s configured to sync with. It also no longer announces that it’s a time server.

Also, all other DCs in the domain no longer announce they’re time servers, and they no longer use the domain hierarchy to sync their time. Therefore, their time setting may no longer be in sync with the setting for their peers, and domain members can no longer sync their time.

You may notice the following warning in the DCDIAG output:

Warning: is not advertising as a time server

You may also notice that the DC doesn’t respond to NTP client requests. This includes failures that occur when you test the NTP server availability by using the w32tm.exe /stripchart tool. For example, the text output may resemble the following output:

c:>w32tm /stripchart /computer: Tracking [10.1.1.100:123]. The current time is 10/28/2016 9:00:00 AM. 09:00:00 error: 0x800705B4:

Domain Members

Domain member servers and computers that are upgraded are no longer configured to use the domain hierarchy to synchronize their time. Instead, they’ll sync their time with the time.windows.com website.

Authoritative Time Server

Windows computers that are manually configured as an Authoritative Time Server lose their configuration. Therefore, devices that are configured to use these computers to synchronize their time may not sync.

You may also notice that the Authoritative NTP server doesn’t respond to NTP client requests. This includes failures that occur when you test the NTP server availability by using the w32tm.exe /stripchart tool. For example, the text output may resemble the following output:

c:>w32tm /stripchart /computer: Tracking [10.1.1.100:123]. The current time is . error: 0x800705B4:

This issue shouldn’t occur when you do an in-place upgrade of the following operating systems:

• Windows 10 version 1507 through Windows 10 version 1511
• Windows 10 version 1511 through Windows 10 version 1607
• Windows Server 2016 Technical Preview 5 (TP5) through Windows Server 2016 (RTM)

Cause

This is a known issue in the Windows upgrade paths that are listed in the «Symptoms» section. This issue occurs because the registry values for the Windows Time service aren’t preserved during an upgrade. Therefore, all Windows Time service values are reverted to the default state of a Workgroup Member Server or a stand-alone computer.

Workaround

This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, go to the following Microsoft Knowledge Base article:
322756 How to back up and restore the registry in Windows

On DCs and domain-joined computers, the Netlogon service must be running before the W32time service can start. After you upgrade the system, make sure that Netlogon is running before you try any of these workarounds.

To work around this issue, use one of the following methods.

Method 1

Before you upgrade to Windows 10 Version 1607 or Windows Server 2016, manually back up the contents under the w32time registry key. To do this, follow these steps:

Open the Run box. To do this, press the Windows logo key‌+R.

Type regedit, and then press Enter.

Locate and then click the following registry entry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\

Click File > Export.

In the Export Registry File dialog box, select the location where you want to save the backup copy, and then type a name for the backup file in the File name field.

Click Save.

Save the W32time configuration for validation. To do this, run the following commands at an elevated command prompt:

You can now upgrade the computer to Windows Server 2016 or Windows 10 Version 1607. After the upgrade is completed, follow these steps to restore the contents under the w32time registry key:

Open the Run box. To do this, press the Windows logo key‌+R.

Type regedit, and then press Enter.

Open the Run box. To do this, press the Windows logo key‌+R.

Type regedit, and then press Enter.

In Registry Editor, click File > Import.

In the Import Registry File dialog box, select the location where you saved the backup copy, select the backup file, and then click Open.

Exit Registry Editor.

Run the following command to remove a deprecated service trigger:

Restart W32time service to enable it to use the new configuration. To do this, run the following commands at an elevated command prompt:

Method 2

If you’re experiencing issues that affect the Windows Time Service after you upgrade to Windows Server 2016 or Windows 10 Version 1607, follow these steps to reregister w32tm.exe .

This procedure restores the default settings that are appropriate for the computer role. It does not restore any customizations that were made by the administrator.

At an elevated command prompt, run the following sequence of commands:

Method 3

If you are experiencing issues that affect the Windows Time Service after you upgrade to Windows Server 2016 or Windows 10 Version 1607, follow these steps to restore your settings from the Windows.old folder.

The following steps should be done only by advanced users.

Export the registry key from Windows.old folder.

Open the Windows Run box. To do this, press the Windows logo key+R.

Type regedit and then press Enter.

Locate and then click HKEY_LOCAL_MACHINE .

On the File menu, click Load Hive.

Locate and then click the C:\Windows.old\Windows\System32\Config\System file, and then click Open.

In the Load Hive dialog box, type Offline, and then click OK.

Expand Offline.

Locate and then click the following registry subkey: ControlSet001\Services\W32Time\

Click File > Export.

In the Export Registry File dialog box, select the location on a local hard disk where you want to save the registry, and then type a name for the backup file in the File name field.

Click Save.

Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\Offline

On the File menu, click Unload Hive, and then click Yes in the Confirm Unload Hive dialog box.

Exit Registry editor.

Restart the computer in Recovery mode.

1. Select Start >Settings >Update & Security >Recovery
2. From the right-side pane, click Restart now under Advanced startup.
3. After the computer restarts, select Troubleshoot, and then select Command Prompt.
4. Select a local admin user, and then insert the password.

This restarts the computer in Recovery mode and provides a Command Prompt window.

Import the saved registry key from step 1.

At the command prompt, type regedit and then press Enter

Locate and then select HKEY_LOCAL_MACHINE

On on the File menu, click Load Hive.

Locate and then select the C:\Windows\System32\Config\System file, and then click Open.

In the Load Hive dialog box, type Offline, and then click OK

Expand Offline.

Locate and then click the following registry subkey: ControlSet001\Services\W32Time\

Click File > Import.

In the Import Registry File dialog box, select the location where you saved the backup copy, select the backup file, and then click Open.

Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\Offline

On the File menu, click Unload Hive, and then click Yes in the Confirm Unload Hive dialog box.

Exit Registry Editor, and then restart the computer in Normal mode.

Verify the workaround results

To verify that the Windows Time service can now preserve its configuration, follow these steps:

Run DCDiag.exe on DCs to make sure that they’re advertising as a time server.

Make sure that DCs or Authoritative NTP Servers respond to NTP client requests without errors. For example, the command output resembles the following:

c:
Tracking [10.1.1.100:123].
The current time is .
d:+00.0013494s o:-00.0891868s [ * ]

For advanced users, query the W32time configuration, and make sure that the time providers are configured as expected. If you used Method 1 as the workaround, you can compare the post-upgrade configuration to the saved pre-configuration data. For example, the command output resembles the following:

c:\ >w32tm /query /configuration /verbose > PostUpgradeW32timeConfiguration.txt

References

For more information about related Netlogon issues, click the following article number to view the article in the Microsoft Knowledge Base:
3201247 Netlogon service doesn’t retain settings after upgrade to Windows Server 2016

Windows Time Service

Applies to: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10 or later

In this guide

• Where to find Windows Time Service Configuration Information
• What is the Windows Time Service?
• Importance of Time Protocols
• How the Windows Time Service Works
• Windows Time Service Tools and Settings

In Windows Server 2003 and Microsoft Windows 2000 Server, the directory service is named Active Directory directory service. In Windows Server 2008 R2 and Windows Server 2008 , the directory service is named Active Directory Domain Services (AD DS). The rest of this topic refers to AD DS, but the information is also applicable to Active Directory Domain Services in Windows Server 2016.

The Windows Time service, also known as W32Time, synchronizes the date and time for all computers running in an AD DS domain. Time synchronization is critical for the proper operation of many Windows services and line-of-business applications. The Windows Time service uses the Network Time Protocol (NTP) to synchronize computer clocks on the network so that an accurate clock value, or time stamp, can be assigned to network validation and resource access requests. The service integrates NTP and time providers, making it a reliable and scalable time service for enterprise administrators.

Prior to Windows Server 2016, the W32Time service was not designed to meet time-sensitive application needs. However, updates to Windows Server 2016 now allow you to implement a solution for 1ms accuracy in your domain. See Windows 2016 Accurate Time and Support boundary to configure the Windows Time service for high-accuracy environments for more information.

Where to Find Windows Time Service Configuration Information

This guide does not discuss configuring the Windows Time service. There are several different topics on Microsoft TechNet and in the Microsoft Knowledge Base that do explain procedures for configuring the Windows Time service. If you require configuration information, the following topics should help you locate the appropriate information.

To configure the Windows Time service for the forest root primary domain controller (PDC) emulator, see:

Microsoft Knowledge Base article 816042, How to configure an authoritative time server in Windows Server, which describes configuration settings for computers running Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, and Windows Server 2003 R2.

To configure the Windows Time service on any domain member client or server, or even domain controllers that are not configured as the forest root PDC emulator, see Configure a client computer for automatic domain time synchronization.

Some applications may require their computers to have high-accuracy time services. If that is the case, you may choose to configure a manual time source, but be aware that the Windows Time service was not designed to function as a highly accurate time source. Ensure that you are aware of the support limitations for high-accuracy time environments as described in Microsoft Knowledge Base article 939322, Support boundary to configure the Windows Time service for high-accuracy environments.

To configure the Windows Time service on any Windows-based client or server computers that are configured as workgroup members instead of domain members see Configure a manual time source for a selected client computer.

To configure the Windows Time service on a host computer that runs a virtual environment, see Microsoft Knowledge Base article 816042, How to configure an authoritative time server in Windows Server. If you are working with a non-Microsoft virtualization product, be sure to consult the documentation of the vendor for that product.

To configure the Windows Time service on a domain controller that is running in a virtual machine, it is recommended that you partially disable time synchronization between the host system and guest operating system acting as a domain controller. This enables your guest domain controller to synchronize time for the domain hierarchy, but protects it from having a time skew if it is restored from a Saved state. For more information, see Microsoft Knowledge Base article 976924, You receive Windows Time Service event IDs 24, 29, and 38 on a virtualized domain controller that is running on a Windows Server 2008-based host server with Hyper-V and Deployment Considerations for Virtualized Domain Controllers.

To configure the Windows Time service on a domain controller acting as the forest root PDC emulator that is also running in a virtual computer, follow the same instructions for a physical computer as described in Configure the Windows Time service on the PDC emulator in the Forest Root Domain.

To configure the Windows Time service on a member server running as a virtual computer, use the domain time hierarchy as described in (Configure a client computer for automatic domain time synchronization.

What is the Windows Time Service?

The Windows Time service (W32Time) provides network clock synchronization for computers without the need for extensive configuration.

The Windows Time service is essential to the successful operation of Kerberos version 5 authentication and, therefore, to AD DS-based authentication. Any Kerberos-aware application, including most security services, relies on time synchronization between the computers that are participating in the authentication request. AD DS domain controllers must also have synchronized clocks to help to ensure accurate data replication.

The Windows Time service is implemented in a dynamic link library called W32Time.dll. W32Time.dll is installed by default in the %Systemroot%\System32 folder during operating system setup and installation.

W32Time.dll was originally developed for Windows 2000 Server to support a specification by the Kerberos V5 authentication protocol that required clocks on a network to be synchronized. Starting with Windows Server 2003, W32Time.dll provided increased accuracy in network clock synchronization over the Windows 2000 Server operating system and, in addition, supported a variety of hardware devices and network time protocols by means of time providers. Although originally designed to provide clock synchronization for Kerberos authentication, many current applications use timestamps to ensure transactional consistency, to record the time of important events, and other business-critical, time-sensitive information. These applications benefit from time synchronization between computers that is provided by the Windows Time service.

Importance of Time Protocols

Time protocols communicate between two computers to exchange time information and then use that information to synchronize their clocks. With the Windows Time service time protocol, a client requests time information from a server and synchronizes its clock based on the information that is received.

The Windows Time service uses NTP to help synchronize time across a network. NTP is an Internet time protocol that includes the discipline algorithms necessary for synchronizing clocks. NTP is a more accurate time protocol than the Simple Network Time Protocol (SNTP) that is used in some versions of Windows; however, W32Time continues to support SNTP to enable backward compatibility with computers running SNTP-based time services such as Windows 2000.