Event ID 5 — Time Provider Service Functions

Applies To: Windows Server 2008

If a computer has been designated as a time provider, it can send the time on to any computer requesting time synchronization at any point in this process.

The Windows Time service time synchronization process involves the following steps:

• Input providers request and receive time samples from configured Network Time Protocol (NTP) time sources.
• These time samples are then passed to the Windows Time Service Manager, which collects all the samples and passes them to the clock discipline subcomponent.
• The clock discipline subcomponent applies all NTP algorithms and selects the best time sample.
• The clock discipline subcomponent adjusts the time of the system clock to the most accurate time by either adjusting the clock rate or directly changing the time.

Event Details

Resolve

Address service shutdown errors

The Windows Time service encountered an error during shutdown. The error in Event Viewer should provide additional information. If you are not able to resolve the issue with the information in the event description:

• Start the Windows Time service.
• If you have not enabled Windows Time service logging, enable it. Attempt to restart the Windows Time service after you enable logging.
• After you enable logging, review the Windows Time log file, and then unregister and register the Windows Time service.

If these steps do not resolve the issue, restart the computer.

Perform the following procedures on the computer that is logging the event to be resolved.

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.

Start the Windows Time service

To start the Windows Time service:

1. Click Start. In Start Search, type services.msc, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. The Services snap-in opens.
2. In the list of services, right-click Windows Time service, and then click Start.

Enable Windows Time service logging

To enable Windows Time service logging:

1. Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
2. Create a folder to receive the Windows Time service log file. At the command prompt, type md c:\W32Time, and then press ENTER. The command creates a directory named W32Time on the C: drive.
3. To enable Windows Time service debug logging, at the command prompt, type w32tm /debug /enable /file:c:\W32Time\w32time.log /size:10000000 /entries:0-116, and then press ENTER.

Review the Windows Time log file

To review the Windows Time log file:

1. Open the w32time.log file in Notepad. In the command prompt window, type start notepad c:\w32time\w32time.log.
2. Scroll to the end of the log to see if you can identify any errors that indicate that Windows Time service values from the registry are null. You can reset the Windows Time service values in the registry by unregistering and then registering the service.

Unregister and register the W32time service

To unregister and register the W32time service:

1. To stop the Windows Time service, at a command prompt, running as an administrator, type net stop w32time, and then press ENTER.
2. To unregister the Windows Time service dynamic-link library (DLL), at a command prompt, type w32tm /unregister, and then press ENTER.
3. To register the Windows Time service DLL, at a command prompt, type w32time /register, and then press ENTER.
4. To start the Windows Time service, at the command prompt, type net start w32time, and then press ENTER.

To learn more about the Windows Time service and related tools, see Windows Time Service Tools and Settings (https://go.microsoft.com/fwlink/?LinkID=42984).

Post-troubleshooting cleanup

You can disable Windows Time debug logging by running the command W32tm /debug /disable. You can also remove the c:\w32time folder and w32time.log file when troubleshooting is complete.

To remove the folder and log file:

1. To remove the log file, you must first stop the Windows Time service. To stop the Windows Time service, at the command prompt, type net stop w32time, and then press ENTER.
2. To remove the c:\w32time folder, at the command prompt, type rd c:\w32time /s /q, and then press ENTER.

You can reset the Windows Time service values in the registry by unregistering and then registering the service.

To unregister and register the W32time service:

1. Stop the Windows Time service. To stop the Windows Time service, at a command prompt, running as an administrator, type net stop w32time, and then press ENTER.
2. To unregister the Windows Time service dynamic-link library (DLL), at the command prompt, type w32tm /unregister, and then press ENTER.
3. To register the Windows Time service DLL, at the command prompt, type w32time /register, and then press ENTER.
4. To start the Windows Time service, at the command prompt, type net start w32time, and then press ENTER.

To learn more about the Windows Time service and related tools, see Windows Time Service Tools and Settings (https://go.microsoft.com/fwlink/?LinkID=42984).

Verify

To verify that the Windows Time service is functioning correctly, check Event Viewer for entries that indicate that the service started successfully and that the system time is synchronizing.

Perform the following procedure on the computer that is logging the event to be resolved.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify that the Windows Time service is functioning correctly:

1. Click Start. In Start Search, type services.msc, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. The Services snap-in opens.
2. In the list of services, confirm that the Windows Time service is running.

When the service starts successfully, the Service Control Manager reports that the Windows Time service has entered the running state (Event ID 7036). The W32Time source in Event Viewer reports receipt of time updates and clock synchronization (Event IDs 37 and 35, respectively).

For more information about the Windows Time service, see the Windows Time Service Technical Reference (https://go.microsoft.com/fwlink/?LinkID=25393).

Related Management Information

Time Provider Service Functions

Active Directory