How to Configure an NTP Server on Windows Server 2025
Turn a Windows Server 2025 machine into an NTP time server using the built-in Windows Time service. Set it as a reliable source, enable the NTP server, restart the service, and open the firewall so clients can sync.
- Difficulty
- Intermediate
- Time required
- 10 minutes
- Steps
- 7
- Platform
- Windows Server 2025
- Version
- Windows Server 2025
- Last tested
- July 8, 2026
Table of contents
Quick Answer
Go to the stepsTo make Windows Server 2025 an NTP server, sync it from a reliable upstream source, set AnnounceFlags to 5 so it advertises as reliable, enable the NtpServer provider, restart the Windows Time service, and open UDP 123 in the firewall. Then verify with w32tm.
- Open an elevated Command Prompt or PowerShell.
- Point the server at a reliable upstream time source with w32tm /config.
- Set AnnounceFlags to 5 and enable the NtpServer provider in the registry.
- Restart the Windows Time service (net stop w32time & net start w32time).
- Allow UDP 123 inbound, then verify with w32tm /query.
Windows Time service (W32Time) registry keys under HKLM\SYSTEM\CurrentControlSet\Services\W32Timereg add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /v Enabled /t REG_DWORD /d 1 /fExpected result: The server answers NTP requests on UDP 123, and w32tm confirms the NTP server is enabled.
Key takeaways
- How to configure Windows Server 2025 as an NTP time server using the built-in Windows Time service, and how to verify clients can sync from it.
- Accurate, consistent time keeps logs, authentication, certificates, and scheduled tasks working across a network. A local NTP server gives your machines one trusted clock.
- Making Windows Server 2025 an NTP server comes down to five changes: reliable source, AnnounceFlags 5, enable NtpServer, restart W32Time, and open UDP 123.
Introduction
Windows Server 2025 includes the Windows Time service, W32Time, which can act as an NTP server and hand out time to clients over the network. NTP, the Network Time Protocol, is how devices agree on the current time. Turning your server into an NTP source means workstations, appliances, and other servers can sync from one trusted clock instead of drifting apart.
By default, W32Time runs as a client and doesn't answer time requests from other machines. To make it a server, you tell it to sync from a reliable upstream source, mark it as reliable, enable the NTP server component, restart the service, and open UDP port 123 in the firewall. This guide walks through each step with the exact commands, then shows how to confirm it's working from a client. The procedure follows Microsoft's own Windows Time service documentation and applies to Windows Server 2025.
Who this is for: Windows and system administrators, MSP technicians, and anyone running a Windows Server 2025 host that other devices should sync their time from.
Before you start
- Access
- Local Administrator rights on the Windows Server 2025 machine.
- Required roles
- Local Administrator
- Local Administrator on the server
- Environment
- A Windows Server 2025 host with the Windows Time service (W32Time), outbound access to an upstream time source, and inbound UDP 123 reachable by clients.
- Vendor
- Microsoft
- Tested environment
- Windows Server 2025 with the Windows Time service (W32Time), verified against Microsoft Learn, July 2026.
- Last tested
- Administrator permissions required
Steps verified against Microsoft's Windows Time service documentation, July 2026.
About 10 minutes.
Warning: Domain controllers use a time hierarchy
In an Active Directory domain, only the PDC emulator should be an authoritative external time source. Don't override the domain time hierarchy on ordinary member domain controllers, or you can cause time skew across the domain.
Note: Group Policy can override these settings
If a Windows Time Service Group Policy applies to this server, its values overwrite the registry. Configure the equivalent GPO settings instead, or the registry changes won't stick.
1Open an elevated command prompt
Get an administrator shell so the commands can change service settings and the registry.
Start > Terminal (Admin)Right-click Start and choose Terminal (Admin) or Command Prompt (Admin). Accept the User Account Control prompt. Every command below needs this elevated session, since changing the Windows Time service and the firewall requires administrator rights.
Expected result: An administrator command prompt or PowerShell window is open.
2Point the server at a reliable upstream time source
Give the server accurate time to serve, and mark it as a reliable source.
HKLM\SYSTEM\CurrentControlSet\Services\W32Time\ParametersConfigure W32Time to sync from an external NTP source and flag the server as reliable. Replace the peer list with your preferred sources if needed. The ,0x9 and ,0x1 suffixes set the sync mode for each peer.
This sets the service Type to NTP, records the upstream peers, and marks the machine as a reliable time source in one command.
w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x1" /syncfromflags:manual /reliable:yes /updateExpected result: The command returns "The command completed successfully."
Note
You can also set these in the registry: Parameters\Type = NTP and Parameters\NtpServer = your space-delimited peer list. Use ,0x8 after each name to force client (NTP) mode if you prefer it over ,0x9.
3Mark the server as a reliable time source (AnnounceFlags = 5)
Tell clients this server is an authoritative, reliable time source.
HKLM\SYSTEM\CurrentControlSet\Services\W32Time\ConfigSet the AnnounceFlags value to 5 so the server advertises itself as a reliable time source. This is the value Microsoft documents for an authoritative time server.
If the server has a poor or intermittent connection to its upstream source, use 10 (0xA) instead, which avoids clients rejecting it during brief sync gaps.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config" /v AnnounceFlags /t REG_DWORD /d 5 /fExpected result: The command reports "The operation completed successfully."
4Enable the NTP server component
Turn on the part of W32Time that actually answers client time requests.
HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServerEnable the NtpServer time provider by setting its Enabled value to 1. This is the switch that lets the Windows Time service respond to NTP requests from other machines.
Without this, the service keeps time for itself but never answers clients.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" /v Enabled /t REG_DWORD /d 1 /fExpected result: The command reports "The operation completed successfully."
5Restart the Windows Time service
Apply the configuration by restarting W32Time.
Restart the Windows Time service so the new settings take effect. The service must stop and start for the NTP server component and flags to load.
In PowerShell you can use Restart-Service w32time instead.
net stop w32time && net start w32timeExpected result: The service stops, then reports the Windows Time service was started successfully.
6Allow NTP through the firewall (UDP 123)
Let clients reach the NTP server by opening the inbound UDP 123 port.
Windows Defender Firewall with Advanced Security > Inbound RulesCreate an inbound firewall rule to allow UDP port 123, the NTP port. If this port is blocked, clients send requests but get no reply.
This PowerShell command adds the rule in Windows Defender Firewall.
New-NetFirewallRule -DisplayName "NTP Server (UDP 123)" -Direction Inbound -Protocol UDP -LocalPort 123 -Action AllowExpected result: PowerShell returns the new rule object, and UDP 123 inbound is now allowed.
Note
Some networks also filter UDP 123 on an external firewall. If clients still can't sync, check that path too.
7Verify the NTP server
Confirm the server is configured correctly and answering clients.
Check the configuration and status on the server, then test from a client. On the server, run the query commands. From a client, run a stripchart against the server's IP or name to confirm it responds.
Look for the NTP server showing as enabled in the configuration output.
w32tm /query /configuration
w32tm /query /status
w32tm /stripchart /computer:<server-ip> /samples:3 /dataonlyExpected result: The configuration shows the NtpServer enabled and AnnounceFlags 5, and the client stripchart returns time offsets.
How to Confirm the NTP Server Is Working
Confirm configuration
A working NTP server on Windows Server 2025 shows two things: the right configuration on the server, and a reply to clients. Run w32tm /query /configuration on the server and look for the NtpServer provider enabled and AnnounceFlags set to 5 (0x5). Then run w32tm /query /status to confirm the server has a valid time source and a reasonable stratum.
The real test is from a client. Run w32tm /stripchart /computer:<server-ip> /samples:3 /dataonly on another machine. If the server is serving time, you get back a small time offset for each sample. If you get an error or a timeout, the server isn't answering yet, and the troubleshooting section below will help.
Normal result: The server config shows NtpServer Enabled = 1 and AnnounceFlags = 5, the status shows a valid source, and a client stripchart returns time offsets.
Abnormal result: The client stripchart times out or errors, or the configuration still shows NtpServer disabled. That usually means the service wasn't restarted or UDP 123 is blocked.
AnnounceFlags
5 (0x5)
Advertises the server as a reliable time source.
NtpServer Enabled
1
The NTP server component answers client requests.
Client stripchart
small offset per sample
Confirms the server is replying over UDP 123.
Troubleshooting
Clients can't sync and the stripchart times out.
Warning
Cause: UDP port 123 inbound is blocked on the server or a network firewall.
Confirm the inbound UDP 123 rule exists in Windows Defender Firewall, and check any network firewall between the client and server. Per Microsoft, if no UDP 123 packets get a reply, the port is being blocked.
The configuration still shows the NtpServer disabled.
Note
Cause: The Windows Time service wasn't restarted after the registry changes.
Restart the service with net stop w32time && net start w32time, then re-run w32tm /query /configuration and confirm NtpServer shows Enabled.
Settings revert after a while.
Warning
Cause: A Windows Time Service Group Policy is applying and overwriting the registry values.
Configure the equivalent settings through Group Policy under Computer Configuration > Administrative Templates > System > Windows Time Service, since GPO values overwrite the registry.
The server itself has the wrong time.
Warning
Cause: It isn't syncing from its upstream source, so it serves bad time to clients.
Force a resync with w32tm /resync /rediscover, then check w32tm /query /status for a valid source and stratum. Verify the upstream peer list and DNS resolution.
Frequently asked questions
What port does the NTP server use?
NTP uses UDP port 123. The server must allow inbound UDP 123 through Windows Defender Firewall and any network firewall, or clients can't reach it.
Why set AnnounceFlags to 5?
AnnounceFlags = 5 (0x5) tells clients the server is a reliable time source. Microsoft documents this value for an authoritative time server. Use 10 (0xA) instead if the server's upstream connection is unreliable.
Do I need to restart the server?
No. You only need to restart the Windows Time service, not the whole machine. Run net stop w32time && net start w32time or Restart-Service w32time after the registry changes.
Can a domain controller be an NTP server?
Yes, but in Active Directory only the PDC emulator should be configured as an authoritative external source. Other domain controllers and members follow the domain time hierarchy, so don't override it on them.
How do I check that time is being served?
From a client, run w32tm /stripchart /computer:<server-ip> /samples:3 /dataonly. If the server is answering, you get a small time offset for each sample. On the server, w32tm /query /configuration confirms the NTP server is enabled.
Conclusion
You've configured Windows Server 2025 as an NTP server using the built-in Windows Time service. You pointed it at a reliable upstream source, set AnnounceFlags to 5 so it advertises as reliable, enabled the NtpServer provider, restarted the service, and opened UDP 123 in the firewall. A quick w32tm query on the server and a stripchart from a client confirm it's serving time.
From here, point your clients at the server and keep an eye on time accuracy with w32tm. If anything looks off, the troubleshooting section covers the common causes: a blocked port, a missing service restart, or a Group Policy overriding your settings.
Making Windows Server 2025 an NTP server comes down to five changes: reliable source, AnnounceFlags 5, enable NtpServer, restart W32Time, and open UDP 123.
HKLM\SYSTEM\CurrentControlSet\Services\W32Time > set AnnounceFlags = 5 and NtpServer Enabled = 1, then restart w32timeSources3
