Event ID 19 — Service Status and Configuration

Applies To: Windows Server 2008

The Windows Time service updates the time server configuration settings or status. Changes to configuration are implemented when the service is restarted and when the W32tm command is used with the /update switch. These configuration or status changes occur when the Windows Time service:

• Enters a running status.
• Sets up the log file to record operational information. The debug logging feature of the Windows Time service can be used to help troubleshoot issues.
• Registers for network configuration change events. Computers use the network to send time samples back and forth.
• Creates a named event, which is a shared resource that is used for synchronizing time.
• Saves configuration settings to the registry.

Event Details

Resolve

Apply sufficient permissions to the log file location

Windows Time service logging is enabled, but the Windows Time service does not have the appropriate permissions to write to the log file location. To resolve this issue, you must first determine where the Windows Time service is trying to write its log files. Then, you must know which account the Windows Time service uses for security permissions. Finally, you must correct the permissions at the log file location.

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority. Perform all steps on the computer that is logging the event to be resolved.

Determine the Windows Time service log file location

To determine the Windows Time service log file location:

Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, back up any valued data.

1. Open Registry Editor. To open Registry Editor, click Start. In Start Search, type regedit, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
2. Navigate to the Config key in the registry by expanding the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time.
3. Select the Config key. You should see a string value named FileLogName in the right pane. The path and file name in the filelogname value tell you where the log is configured to be written. If you cannot read the full path and file name, double-click the FileLogName value. The Edit String dialog box appears, displaying the entire path and file name. Note the volume name and location. If you opened the Edit String dialog box, click Cancel to close it.
4. Locate the Data column in the FileLogSize value. The number on the right in parentheses indicates how large the log is allowed to become. The value is recorded in bytes; therefore, a decimal value of 10,485,760 is 10 MB.

Determine that the log path exists and that the Windows Time service can access it

To determine that the log path exists and that the Windows Time service can access it:

1. Click Start. In Start Search, type services.msc, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. The Services snap-in opens.
2. In the list of services in the Name column, double-click the Windows Time service. The Windows Time Properties (Local Computer) dialog box opens.
3. Click the Log On tab. Record the name of the account that the Windows Time service is configured to use. By default, the account name is Local Service. If the setting is not at the default, configure a valid account and password for the Windows Time service to use.
4. If you made any changes, click OK. Otherwise, click Cancel to close the dialog box.

Correct the permissions at the log file location

To correct the permissions at the log file location:

1. Click Start, click Run, and then type the path to the log file to which the Windows Time service is configured to write. Type the path to the file only, not the file name.
2. Click OK. Windows Explorer opens the folder path. If you get an error, check that you typed the path correctly. If the path does not exist, you must return to Registry Editor and change the data path for the FileLogName value to point to a valid location.
3. Right-click the Windows Time service log file object, and then click Properties. The file Properties dialog box opens.
4. Click the Security tab. If you do not see the account in the list of accounts, click Edit. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
5. Click Add. The Select Users, Computers, or Groups dialog box opens.
6. In the Enter the object names to select dialog box, type the name of the account that the Windows Time service is configured to use.
7. Click Check Names. If you added the account named Local Service, you see a Multiple Account Names Found dialog box.
8. Select the LOCAL SERVICE account, and then click OK.
9. Click OK to confirm the account in the Select Users, Computers, or Groups dialog box. The dialog box closes.
10. With the account name that you entered selected in the Permissions for the log file name dialog box, select the Allow box in the Full Control row of the Permissions for account name section. Click OK. The dialog box closes.

Verify

To verify that the Windows Time service is functioning properly, restart the service, and then check Event Viewer for entries that indicate a successful restart and system time synchronization.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify that the Windows Time service is functioning properly:

1. Click Start. In Start Search, type services.msc, and then click OK. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
2. In the list of services, right-click Windows Time, and then click Restart.

When the service restarts successfully, the Service Control Manager reports that the Windows Time service has entered the running state (Event ID 7036) in the Event Viewer. The W32Time source in Event Viewer also reports that the Windows Time service is successfully receiving and synchronizing its clock (Event IDs 37 and 35, respectively).

For more information about the Windows Time service, see Windows Time Service Technical Reference https://go.microsoft.com/fwlink/?LinkID=25393).

Related Management Information

Service Status and Configuration

Active Directory