Moorfox
PowerShell: force a Windows time sync
Run w32tm /resync /force from an elevated prompt, then w32tm /query /status to confirm the source and offset. If the resync errors with "the service has not been started", start w32time first. Clock skew beyond five minutes breaks Kerberos sign-ins, which is usually why you are here.
Start-Service w32time -ErrorAction SilentlyContinue
w32tm /resync /force
w32tm /query /statusNotes before you run it
- Domain-joined machines should show a domain controller as the source. A workgroup machine syncing from
Local CMOS Clockis not syncing at all; point it somewhere withw32tm /config /syncfromflags:manual /manualpeerlist:"pool.ntp.org" /update. - Skew that returns after every reboot on older hardware is a dying CMOS battery, not a Windows problem.
- Virtual machines should usually sync from the domain hierarchy, not the hypervisor and the domain at once; pick one.
Where the machine is getting its time from
w32tm /query /source prints the current source in one line. w32tm /query /configuration prints the whole effective config, including whether settings came from Group Policy. w32tm /query /peers lists configured peers and when each was last polled.
The Type value in the configuration is the thing to read: NT5DS means follow the domain hierarchy, NTP means use the manual peer list, AllSync means try both. A domain member should be NT5DS. A machine set to NTP while domain-joined is a common misconfiguration left behind by a build script.
Fixing the domain hierarchy rather than the machine
In a domain, only one machine should reach outside: the domain controller holding the PDC Emulator FSMO role. Everything else follows the hierarchy down from it. On the PDC Emulator:
w32tm /config /manualpeerlist:"0.pool.ntp.org,0x9 1.pool.ntp.org,0x9" /syncfromflags:manual /reliable:yes /update
then restart w32time. On every other domain controller and member:
w32tm /config /syncfromflags:domhier /update.
Fixing one workstation when the PDC Emulator itself is wrong means the workstation drifts back within a poll interval. Check the PDC Emulator first when more than one machine is out.
When the resync command fails
"Access is denied" (0x80070005) means the prompt is not elevated. "The computer did not resync because no time data was available" means the machine reached nothing: UDP 123 outbound is the usual block, on the firewall or at the ISP. "The service has not been started" means w32time is stopped or disabled. It is set to Manual (Trigger Start) by default on workstations, which is normal.
A full reset when the config is beyond repair, elevated, in order:
net stop w32time, w32tm /unregister, w32tm /register, net start w32time, w32tm /resync /force.
w32tm /unregister wipes the service configuration, so the domain hierarchy settings need to reapply afterwards (a reboot or gpupdate does it).
Hyper-V and VMware guests
The Hyper-V "Time synchronization" integration service syncs the guest to the host. On a domain-joined guest that fights the domain hierarchy. Microsoft's position is to leave the integration service enabled on a domain-joined guest but let the domain hierarchy win, or disable time synchronisation in the VM settings if the host is not itself reliably synced.
A virtualised domain controller holding the PDC Emulator role is the worst case: it takes time from the host and hands it to the whole domain. Disable host time sync on that guest specifically and point it at an external source.
Frequently asked questions
Why does a wrong clock break sign-ins?
Kerberos rejects a ticket whose timestamp is outside the allowed skew. The default maximum tolerance is five minutes, set by the "Maximum tolerance for computer clock synchronization" policy. Past that, sign-ins and access to domain resources fail with clock skew errors even though the password is right.
What port does Windows time use?
UDP 123, outbound. It is the single most common thing blocked when a machine reports no time data available.
How often does Windows sync on its own?
A domain member polls the hierarchy roughly every 45 minutes until three consecutive syncs succeed, then backs off to every eight hours. A standalone machine syncs to time.windows.com on a weekly schedule, which is why standalone machines drift noticeably.
Can this run from Command Prompt instead of PowerShell?
Yes. w32tm is a Windows executable, not a cmdlet, so every w32tm command here is identical in Command Prompt. Only Start-Service is PowerShell, and net start w32time is the equivalent.
Run it on every machine, not one at a time.
Save any of these as a command in Moorfox and run it on a machine in one click, output and exit code captured, with no PSRemoting or WinRM setup. The agent runs it locally and reports back, even over the internet.