Windows Time Service

Applies to: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10 or later

In this guide

• Where to find Windows Time Service Configuration Information
• What is the Windows Time Service?
• Importance of Time Protocols
• How the Windows Time Service Works
• Windows Time Service Tools and Settings

In Windows Server 2003 and Microsoft Windows 2000 Server, the directory service is named Active Directory directory service. In Windows Server 2008 R2 and Windows Server 2008 , the directory service is named Active Directory Domain Services (AD DS). The rest of this topic refers to AD DS, but the information is also applicable to Active Directory Domain Services in Windows Server 2016.

The Windows Time service, also known as W32Time, synchronizes the date and time for all computers running in an AD DS domain. Time synchronization is critical for the proper operation of many Windows services and line-of-business applications. The Windows Time service uses the Network Time Protocol (NTP) to synchronize computer clocks on the network so that an accurate clock value, or time stamp, can be assigned to network validation and resource access requests. The service integrates NTP and time providers, making it a reliable and scalable time service for enterprise administrators.

Prior to Windows Server 2016, the W32Time service was not designed to meet time-sensitive application needs. However, updates to Windows Server 2016 now allow you to implement a solution for 1ms accuracy in your domain. See Windows 2016 Accurate Time and Support boundary to configure the Windows Time service for high-accuracy environments for more information.

Where to Find Windows Time Service Configuration Information

This guide does not discuss configuring the Windows Time service. There are several different topics on Microsoft TechNet and in the Microsoft Knowledge Base that do explain procedures for configuring the Windows Time service. If you require configuration information, the following topics should help you locate the appropriate information.

To configure the Windows Time service for the forest root primary domain controller (PDC) emulator, see:

Microsoft Knowledge Base article 816042, How to configure an authoritative time server in Windows Server, which describes configuration settings for computers running Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, and Windows Server 2003 R2.

To configure the Windows Time service on any domain member client or server, or even domain controllers that are not configured as the forest root PDC emulator, see Configure a client computer for automatic domain time synchronization.

Some applications may require their computers to have high-accuracy time services. If that is the case, you may choose to configure a manual time source, but be aware that the Windows Time service was not designed to function as a highly accurate time source. Ensure that you are aware of the support limitations for high-accuracy time environments as described in Microsoft Knowledge Base article 939322, Support boundary to configure the Windows Time service for high-accuracy environments.

To configure the Windows Time service on any Windows-based client or server computers that are configured as workgroup members instead of domain members see Configure a manual time source for a selected client computer.

To configure the Windows Time service on a host computer that runs a virtual environment, see Microsoft Knowledge Base article 816042, How to configure an authoritative time server in Windows Server. If you are working with a non-Microsoft virtualization product, be sure to consult the documentation of the vendor for that product.

To configure the Windows Time service on a domain controller that is running in a virtual machine, it is recommended that you partially disable time synchronization between the host system and guest operating system acting as a domain controller. This enables your guest domain controller to synchronize time for the domain hierarchy, but protects it from having a time skew if it is restored from a Saved state. For more information, see Microsoft Knowledge Base article 976924, You receive Windows Time Service event IDs 24, 29, and 38 on a virtualized domain controller that is running on a Windows Server 2008-based host server with Hyper-V and Deployment Considerations for Virtualized Domain Controllers.

To configure the Windows Time service on a domain controller acting as the forest root PDC emulator that is also running in a virtual computer, follow the same instructions for a physical computer as described in Configure the Windows Time service on the PDC emulator in the Forest Root Domain.

To configure the Windows Time service on a member server running as a virtual computer, use the domain time hierarchy as described in (Configure a client computer for automatic domain time synchronization.

What is the Windows Time Service?

The Windows Time service (W32Time) provides network clock synchronization for computers without the need for extensive configuration.

The Windows Time service is essential to the successful operation of Kerberos version 5 authentication and, therefore, to AD DS-based authentication. Any Kerberos-aware application, including most security services, relies on time synchronization between the computers that are participating in the authentication request. AD DS domain controllers must also have synchronized clocks to help to ensure accurate data replication.

The Windows Time service is implemented in a dynamic link library called W32Time.dll. W32Time.dll is installed by default in the %Systemroot%\System32 folder during operating system setup and installation.

W32Time.dll was originally developed for Windows 2000 Server to support a specification by the Kerberos V5 authentication protocol that required clocks on a network to be synchronized. Starting with Windows Server 2003, W32Time.dll provided increased accuracy in network clock synchronization over the Windows 2000 Server operating system and, in addition, supported a variety of hardware devices and network time protocols by means of time providers. Although originally designed to provide clock synchronization for Kerberos authentication, many current applications use timestamps to ensure transactional consistency, to record the time of important events, and other business-critical, time-sensitive information. These applications benefit from time synchronization between computers that is provided by the Windows Time service.

Importance of Time Protocols

Time protocols communicate between two computers to exchange time information and then use that information to synchronize their clocks. With the Windows Time service time protocol, a client requests time information from a server and synchronizes its clock based on the information that is received.

The Windows Time service uses NTP to help synchronize time across a network. NTP is an Internet time protocol that includes the discipline algorithms necessary for synchronizing clocks. NTP is a more accurate time protocol than the Simple Network Time Protocol (SNTP) that is used in some versions of Windows; however, W32Time continues to support SNTP to enable backward compatibility with computers running SNTP-based time services such as Windows 2000.

Windows Time Service (W32Time)

Applies to: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10 or later

The Windows Time service (W32Time) synchronizes the date and time for all computers running in Active Directory Domain Services (AD DS). Time synchronization is critical for the proper operation of many Windows services and line-of-business (LOB) applications. The Windows Time service uses the Network Time Protocol (NTP) to synchronize computer clocks on the network. NTP ensures that an accurate clock value, or timestamp, can be assigned to network validation and resource access requests.

In the Windows Time Service (W32Time) topic, the following content is available:

• Windows Server 2016 Accurate Time. Time synchronization accuracy in Windows Server 2016 has been improved substantially, while maintaining full backwards NTP compatibility with older Windows versions. Under reasonable operating conditions you can maintain a 1 ms accuracy with respect to UTC or better for Windows Server 2016 and Windows 10 Anniversary Update domain members.
• Support boundary for high-accuracy environments. This article describes the support boundaries for the Windows Time service (W32Time) in environments that require highly accurate and stable system time.
• Configuring Systems for high accuracy. Time synchronization in Windows 10 and Windows Server 2016 has been substantially improved. Under reasonable operating conditions, systems can be configured to maintain 1ms (millisecond) accuracy or better (with respect to UTC).
• Windows Time for Traceability. Regulations in many sectors require systems to be traceable to UTC. This means that a system’s offset can be attested with respect to UTC. To enable regulatory compliance scenarios, Windows 10 and Server 2016 provides new event logs to provide a picture from the perspective of the Operating System to form an understanding of the actions taken on the system clock. These event logs are generated continuously for Windows Time service and can be examined or archived for later analysis.
• Windows Time service technical reference. The W32Time service provides network clock synchronization for computers without the need for extensive configuration. The W32Time service is essential to the successful operation of Kerberos V5 authentication and, therefore, to AD DS-based authentication.
  • How the Windows Time service works. Although the Windows Time service is not an exact implementation of the Network Time Protocol (NTP), it uses the complex suite of algorithms that is defined in the NTP specifications to ensure that clocks on computers throughout a network are as accurate as possible.
  • Windows Time service tools and settings. Most domain member computers have a time client type of NT5DS, which means that they synchronize time from the domain hierarchy. The only typical exception to this is the domain controller that functions as the primary domain controller (PDC) emulator operations master of the forest root domain, which is usually configured to synchronize time with an external time source.

Related Topics

For more information about the domain hierarchy and scoring system, see the «What is Windows Time Service?» blog post.

The windows time provider plugin model is documented on TechNet.

An addendum referenced by the Windows 2016 Accurate Time article can be downloaded here

For a quick overview of Windows Time service, take a look at this high-level overview video.

Служба времени Windows (W32Time) Windows Time Service (W32Time)

Применяется к: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10 или более поздних версий Applies to: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10 or later

Служба времени Windows (W32Time) синхронизирует дату и время для всех компьютеров, работающих в домене AD DS (доменные службы Active Directory). The Windows Time service (W32Time) synchronizes the date and time for all computers running in Active Directory Domain Services (AD DS). Синхронизация времени важна для правильной работы многих служб Windows и бизнес-приложений. Time synchronization is critical for the proper operation of many Windows services and line-of-business (LOB) applications. Служба времени Windows использует протокол NTP для синхронизации времени на компьютерах в сети. The Windows Time service uses the Network Time Protocol (NTP) to synchronize computer clocks on the network. NTP гарантирует назначение точного значения времени (отметки времени) запросам проверки сети и доступа к ресурсам. NTP ensures that an accurate clock value, or timestamp, can be assigned to network validation and resource access requests.

В разделе о службе времени Windows (W32Time) представлено следующее содержимое. In the Windows Time Service (W32Time) topic, the following content is available:

• Точное время в Windows Server 2016.Windows Server 2016 Accurate Time. Теперь точность синхронизации времени в Windows Server 2016 значительно увеличена, при этом обеспечивается полная обратная совместимость NTP с более ранними версиями Windows. Time synchronization accuracy in Windows Server 2016 has been improved substantially, while maintaining full backwards NTP compatibility with older Windows versions. При обычных условиях работы вы сможете поддерживать точность до 1 мс или лучше относительно времени UTC для участников домена, работающих под управлением ОС Windows Server 2016 или Windows 10 (юбилейное обновление). Under reasonable operating conditions you can maintain a 1 ms accuracy with respect to UTC or better for Windows Server 2016 and Windows 10 Anniversary Update domain members.
• Граница области поддержки для высокоточного времени.Support boundary for high-accuracy environments. В этой статье описываются границы области поддержки службы времени Windows (W32Time) в средах, требующих высокой точности и стабильного системного времени. This article describes the support boundaries for the Windows Time service (W32Time) in environments that require highly accurate and stable system time.
• Настройка высокой точности в системах.Configuring Systems for high accuracy. Синхронизация времени в Windows 10 и Windows Server 2016 была значительно улучшена. Time synchronization in Windows 10 and Windows Server 2016 has been substantially improved. При разумных условиях работы можно настроить системы для поддержания точности до 1 мс (миллисекунды) или еще точнее (относительно UTC). Under reasonable operating conditions, systems can be configured to maintain 1ms (millisecond) accuracy or better (with respect to UTC).
• Использование службы времени Windows для отслеживания.Windows Time for Traceability. Согласно нормативам во многих сферах требуются системы для отслеживания в формате UTC. Regulations in many sectors require systems to be traceable to UTC. Это означает, что должно подтверждаться определенное смещение времени системы относительно UTC. This means that a system’s offset can be attested with respect to UTC. Чтобы поддерживать сценарии соответствия нормативным требованиям, Windows 10 и Windows Server 2016 предоставляют новые журналы событий, чтобы представить картину с точки зрения операционной системы для понимания действий с системными часами. To enable regulatory compliance scenarios, Windows 10 and Server 2016 provides new event logs to provide a picture from the perspective of the Operating System to form an understanding of the actions taken on the system clock. Эти журналы событий создаются постоянно для службы времени Windows. Их можно проверять и архивировать для последующего анализа. These event logs are generated continuously for Windows Time service and can be examined or archived for later analysis.
• Технический справочник по службе времени Windows.Windows Time service technical reference. Служба времени W32Time обеспечивает синхронизацию сетевых часов для компьютеров без необходимости в расширенной конфигурации. The W32Time service provides network clock synchronization for computers without the need for extensive configuration. Служба W32Time необходима для успешной работы проверки подлинности Kerberos версии 5 и, следовательно, для проверки подлинности на основе AD DS. The W32Time service is essential to the successful operation of Kerberos V5 authentication and, therefore, to AD DS-based authentication.
  • Принципы работы службы времени Windows.How the Windows Time service works. Хотя служба времени Windows не является точной реализацией протокола сетевого времени (NTP), она использует комплексный набор алгоритмов, определенных в спецификациях NTP, чтобы гарантировать максимальную точность часов на компьютерах в сети. Although the Windows Time service is not an exact implementation of the Network Time Protocol (NTP), it uses the complex suite of algorithms that is defined in the NTP specifications to ensure that clocks on computers throughout a network are as accurate as possible.
  • Инструменты и параметры службы времени Windows.Windows Time service tools and settings. Большинство компьютеров-членов домена имеют тип клиента NT5DS, что означает синхронизацию времени из иерархии доменов. Most domain member computers have a time client type of NT5DS, which means that they synchronize time from the domain hierarchy. Единственным типичным исключением является контроллер домена, который выступает в роли хозяина операций эмулятора основного контроллера домена (PDC) корневого домена леса, который обычно настроен для синхронизации времени с внешним источником времени. The only typical exception to this is the domain controller that functions as the primary domain controller (PDC) emulator operations master of the forest root domain, which is usually configured to synchronize time with an external time source.

Связанные разделы Related Topics

Дополнительные сведения об иерархии доменов и системе оценки см. в записи блога, посвященной службе времени Windows. For more information about the domain hierarchy and scoring system, see the «What is Windows Time Service?» . blog post.

Модель подключаемого модуля поставщика времени Windows описана в документации в TechNet. The windows time provider plugin model is documented on TechNet.

Дополнение, на которое ссылается статья о точном времени в Windows 2016, можно скачать здесь. An addendum referenced by the Windows 2016 Accurate Time article can be downloaded here

Краткий обзор службы времени Windows см. в этом видео. For a quick overview of Windows Time service, take a look at this high-level overview video.