How to Configure NTP Time Synchronization on Windows Server

Before changing anything, establish where this server sits in the Active Directory time hierarchy. By default, domain-joined machines synchronize their clock up the domain hierarchy: member servers and workstations sync from a domain controller, domain controllers sync from the PDC emulator, and the PDC emulator in the forest root domain is the single machine that should point to an external NTP source. This keeps the whole forest anchored to one authoritative clock.

Only configure an external NTP peer list on the forest root PDC emulator (or on a standalone/workgroup server). Leaving every domain member syncing from the domain avoids clock conflicts that break Kerberos authentication.

To find which domain controller currently holds the PDC emulator role, open an elevated Command Prompt and run the command below.

Pick reliable, low-latency NTP sources for the PDC emulator (or standalone server) to synchronize with. Good options include:

• pool.ntp.org - a large rotating pool of community NTP servers (e.g. 0.pool.ntp.org, 1.pool.ntp.org).
• time.windows.com - Microsoft's public NTP service, the default on Windows.
• An internal hardware time source (such as a GPS/atomic reference clock or an appliance) if your environment requires it.

List multiple peers so W32Time has redundancy if one source is unreachable. Each peer is followed by a flag; for standard NTP client synchronization, append ,0x8, which requests time using client mode. Separate multiple peers with spaces inside the quoted list, for example:

"0.pool.ntp.org,0x8 1.pool.ntp.org,0x8 time.windows.com,0x8"

Confirm outbound UDP port 123 is permitted through any firewall between this server and the chosen sources before continuing.

On the PDC emulator (or standalone server), open an elevated Command Prompt and configure the Windows Time service to use your chosen peers. Run the main command below, substituting your own peer list if you selected different servers in the previous step.

Each parameter does the following:

• /manualpeerlist:"..." - sets the space-separated list of external NTP peers to synchronize with. The 0x8 flag requests time in client mode.
• /syncfromflags:manual - tells W32Time to sync only from the peers in the manual peer list (rather than from the AD domain hierarchy).
• /reliable:yes - marks this machine as a reliable time source, appropriate for the PDC emulator that the rest of the domain trusts.
• /update - notifies the running time service that its configuration has changed so it re-reads the settings.

The /update switch signals the service, but restarting W32Time ensures the new peer list and flags are fully applied. From the same elevated Command Prompt, stop and start the service:

Run net stop w32time followed by net start w32time. On PowerShell you can instead use a single command, Restart-Service w32time.

Also confirm the service is configured to run and start automatically. You can check its state with sc query w32time and its start type in Services (services.msc). The Windows Time service must be running for synchronization to occur.

Force W32Time to synchronize now instead of waiting for its next poll interval, then confirm it is pulling time from your configured NTP peers.

1. Run w32tm /resync to trigger an immediate synchronization.
2. Run w32tm /query /status to review the current status - check the Stratum, Source, Last Successful Sync Time, and Leap Indicator values.
3. Run w32tm /query /source to confirm the active time source is one of the external NTP peers you configured (not "Local CMOS Clock" or "Free-running System Clock").