I am reposting a previous question, because I did not see a way to reopen the last. I thought my issues had been resolved, but come to find out it had only disapeared for a few days. I keep recieving the following event log every day to every other day:Event Type: WarningEvent Source: W32TimeEvent Category: NoneEvent ID: 50Date: 10/4/2009Time: 5:59:04 AMUser: N/AComputer: OPMGR1Description:The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.This box is a monitoring box and reports critical events on our infastructure. This boxes provides a time stamp when reporting to our techs. We need this time to be very accurate. There is no reason it should skew in time regularly.1. Symptom description: Server reports time synchronization error / inaccurate time sporadically on a daily to every other day basis. 2. Environment: The enviroment is multi-subnet / multi-location enviroment. There are mutiple DCs and member servers on the network. Server in question is:Computer Name: OPMGR1Caption: Microsoft(R) Windows(R) Server 2003, Standard EditionVersion: 5.2.3790Build Number: 3790Build Type: Multiprocessor FreeOS Type: 18Other Type Description: Service Pack: 2.0 Boot Device: \Device\HarddiskVolume1Build Number: 3790Build Type: Multiprocessor FreeCaption: Microsoft(R) Windows(R) Server 2003, Standard EditionCode Set: 1252Country Code: 1Debug: FalseEncryption Level: 168Licensed Users: 0Organization: Pilot Catastrophe Services, Inc.OS Language: 1033OS Product Suite: 272OS Type: 18Primary: TrueRegistered User: MIS DepartmentSerial Number: 69712-640-1042313-45518Version: 5.2.3790 PC InformationDomain: pilotcat.comManufacturer/Model: Supermicro - P4SC8NumberOfProcessors: 2PartOfDomain: TrueStatus: OKSystemStartupOptions: "Windows Server 2003, Standard" /noexecute=optout /fastdetectSystemStartupOptions: "Microsoft Windows Recovery Console" /cmdconsSystemStartupSetting: 0SystemType: X86-based PCThermalState: 2RAM: 2,047.41 MB 3. The exact error message: Event Type: WarningEvent Source: W32TimeEvent Category: NoneEvent ID: 50Date: 9/17/2009Time: 7:45:25 PMUser: N/AComputer: OPMGR1Description:The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: WarningEvent Source: W32TimeEvent Category: NoneEvent ID: 50Date: 9/16/2009Time: 7:57:11 PMUser: N/AComputer: OPMGR1Description:The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Occured 21 Times Out Of 22 days 4. Any recent relevant configuration change(s): How to turn on debug logging in the Windows Time Servicehttp://support.microsoft.com/kb/816043 Attempted to have sync from domheir using w32tm commands. Command worked, but then error reoccured.5. Tech diagnosis history: 6. Log file(s): Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time]"Description"="Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. ""DisplayName"="Windows Time""ErrorControl"=dword:00000001"FailureActions"=hex:05,00,00,00,00,00,00,00,00,00,00,00,02,00,00,00,64,00,20,\ 00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00"Group"="""ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ 6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\ 00,65,00,00,00"Objectname"="NT AUTHORITY\\LocalService""Start"=dword:00000002"Type"=dword:00000020"DependOnService"=hex(7):4c,00,61,00,6e,00,6d,00,61,00,6e,00,57,00,6f,00,72,00,\ 6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,64,00,6e,00,73,00,63,\ 00,61,00,63,00,68,00,65,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config]"LastClockRate"=dword:000260d4"MinClockRate"=dword:000260d4"MaxClockRate"=dword:000263e0"FrequencyCorrectRate"=dword:00000004"PollAdjustFactor"=dword:00000005"LargePhaseOffset"=dword:02faf080"SpikeWatchPeriod"=dword:00000384"HoldPeriod"=dword:00000005"LocalClockDispersion"=dword:0000000a"EventLogFlags"=dword:00000002"PhaseCorrectRate"=dword:00000001"MinPollInterval"=dword:0000000a"MaxPollInterval"=dword:0000000f"UpdateInterval"=dword:00007530"MaxNegPhaseCorrection"=dword:ffffffff"MaxPosPhaseCorrection"=dword:ffffffff"AnnounceFlags"=dword:0000000a"MaxAllowedPhaseOffset"=dword:0000012c"FileLogSize"=dword:00989680"FileLogEntries"="0-300""FileLogName"="C:\\WINDOWS\\system32\\LogFiles\\w32time.log" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters]"ServiceMain"="SvchostEntry_W32Time""ServiceDll"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,33,00,\ 32,00,74,00,69,00,6d,00,65,00,2e,00,64,00,6c,00,6c,00,00,00"NtpServer"="PILOTCATPDC""Type"="NT5DS" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Security]"Security"=hex:01,00,14,80,a8,00,00,00,b4,00,00,00,14,00,00,00,30,00,00,00,02,\ 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,02,00,78,00,05,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\ 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ 20,02,00,00,00,00,18,00,8d,00,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,\ 02,00,00,00,00,14,00,9d,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,00,\ 18,00,9d,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,00,\ 00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient]"Enabled"=dword:00000001"InputProvider"=dword:00000001"AllowNonstandardModeCombinations"=dword:00000001"CrossSiteSyncFlags"=dword:00000002"ResolvePeerBackoffMinutes"=dword:0000000f"ResolvePeerBackoffMaxTimes"=dword:00000007"CompatibilityFlags"=dword:80000000"EventLogFlags"=dword:00000001"LargeSampleSkew"=dword:00000003"DllName"="C:\\WINDOWS\\system32\\w32time.dll""SpecialPollTimeRemaining"=hex(7):00,00"SpecialPollInterval"=dword:00000e10 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer]"InputProvider"=dword:00000000"AllowNonstandardModeCombinations"=dword:00000001"DllName"="C:\\WINDOWS\\system32\\w32time.dll""Enabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Enum]"0"="Root\\LEGACY_W32TIME\\0000""Count"=dword:00000001"NextInstance"=dword:00000001David D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator

Log available if upload workgroup is made available.David D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator

What time server are you using? Maybe you have choosen a very busy one. Also check that this server has a reliable connection to the time server on the correct port (UDP 123) http://tf.nist.gov/tf-cgi/servers.cgi http://support.microsoft.com/kb/832017Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect

I am requesting time from the domhier which in my case is PILOTCATPDC --HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters]"ServiceMain"="SvchostEntry_W32Time""ServiceDll"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,33,00,\ 32,00,74,00,69,00,6d,00,65,00,2e,00,64,00,6c,00,6c,00,00,00"NtpServer"="PILOTCATPDC""Type"="NT5DS"The DomHier should not be overly taxed because it only provides time locally to the servers. I have also confirmed with our network guys that all ports are currently open for time communication on the network using Microsoft supplied list of ports.David D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator

Does it ever work? So if you do a;net time /setwhat happens? What did you find in the w32time.log file? You might try using the IP address for a while to prove it isn't DNS issue.-- Regards,Dave Patrick ....Please no email replies - reply in newsgroup.Microsoft Certified ProfessionalMicrosoft MVP [Windows]http://www.microsoft.com/protecto Jr" wrote:I am requesting time from the domhier which in my case is PILOTCATPDC --HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters]"ServiceMain"="SvchostEntry_W32Time""ServiceDll"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,33,00,\ 32,00,74,00,69,00,6d,00,65,00,2e,00,64,00,6c,00,6c,00,00,00"NtpServer"="PILOTCATPDC""Type"="NT5DS"The DomHier should not be overly taxed because it only provides time locally to the servers. I have also confirmed with our network guys that all ports are currently open for time communication on the network using Microsoft supplied list of ports.David D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect

It does work 90% of the time. But once a day I get the error saying it is not in sync. Now I know that if it loses sync then regains it later in the day that is not a big problem, but losing sync on a daily basis once a day shows me it is systemic of someting else. As for the IP address our network team does not want to use that method because the DOMHIER is dynamic and AD is used to tell the server where to locate its time. Or so that is how it was explained to me.DavidDavid D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator

Checked DNS Record, DHCP Lease, and ADUC Information on OPMGr1 and PilotCatPDC (DOMHIER). Both currently have clean records, IP, and ADUC Data.DavidDavid D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator

What does the w32time.log file show?-- Regards,Dave Patrick ....Please no email replies - reply in newsgroup.Microsoft Certified ProfessionalMicrosoft MVP [Windows]http://www.microsoft.com/protect"David D. Ditto Jr" wrote:It does work 90% of the time. But once a day I get the error saying it is later in the day that is not a big problem, but losing sync on a daily basis once a day shows me it is systemic of someting else.As for the IP address our network team does not want to use that method because the DOMHIER is dynamic and AD is used to tell the server where to locate its time. Or so that is how it was explained to me.DavidDavid D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect

Can somone open a working group area to upload files? I would like to provide a list of errors so the team can see the frequancy and I would like to provide the log to be reviewed by smarter individuals that I.DavidDavid D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator

Dave,I probably can't read it properly either. Documentation is hard to find for the logging tool. You might try sending Ryan an email.http://blogs.msdn.com/w32time/default.aspxRegards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect

149282 18:46:25.0223660s - ReadConfig: failed. Use default one 'TimeJumpAuditOffset'=0x00007080149295 10:58:32.1946984s - PeerPollingThread: WaitTimeout149295 10:58:32.1946984s - PeerPollingThread: waiting 32.457s149295 10:59:04.5952900s - PeerPollingThread: WaitTimeout149295 10:59:04.5952900s - PeerPollingThread: waiting 0.056s149295 10:59:04.6420666s - PeerPollingThread: WaitTimeout149295 10:59:04.6420666s - PeerPollingThread: waiting 0.010s149295 10:59:04.6576588s - PeerPollingThread: WaitTimeout149295 10:59:04.6576588s - Polling peer hilldc1.pilotcat.com (ntp.d|192.168.1.53:123->192.168.1.55:123)149295 10:59:04.6576588s - Peer poll: Max:16384.0000000s Cur:00.0000000s149295 10:59:04.6576588s - PeerPollingThread: waiting 16384.000s149295 10:59:04.6576588s - ListeningThread -- DataAvailEvent set for socket 0 (192.168.1.53:123)149295 10:59:04.6576588s - ListeningThread -- response heard from 192.168.1.55:123149295 10:59:04.6576588s - /-- NTP Packet:149295 10:59:04.6576588s - | LeapIndicator: 0 - no warning; VersionNumber: 3; Mode: 4 - Server; LiVnMode: 0x1C149295 10:59:04.6576588s - | Stratum: 3 - secondary reference (syncd by (S)NTP)149295 10:59:04.6576588s - | Poll Interval: 14 - 16384s; Precision: -6 - 15.625ms per tick149295 10:59:04.6576588s - | RootDelay: 0x0000.1BFEs - 0.109344s; RootDispersion: 0x0000.247Ds - 0.142532s149295 10:59:04.6576588s - | ReferenceClockIdentifier: 0xC0A80159 - source IP: 192.168.1.89149295 10:59:04.6576588s - | ReferenceTimestamp: 0xCE72FBB86BAE4522149295 10:59:04.6576588s - - 12899126840420627900ns - 149295 10:47:20.4206279s149295 10:59:04.6576588s - | OriginateTimestamp: 0xCE72FE78A85C53BD149295 10:59:04.6576588s - - 12899127544657658800ns - 149295 10:59:04.6576588s149295 10:59:04.6576588s - | ReceiveTimestamp: 0xCE72FE2E4F854F5F149295 10:59:04.6576588s - - 12899127470310627900ns - 149295 10:57:50.3106279s149295 10:59:04.6576588s - | TransmitTimestamp: 0xCE72FE2E4F854F5F149295 10:59:04.6576588s - - 12899127470310627900ns - 149295 10:57:50.3106279s149295 10:59:04.6576588s - >-- Non-packet info:149295 10:59:04.6576588s - | DestinationTimestamp: 149295 10:59:04.6576588s - 0xCE72FE78A85C53BD149295 10:59:04.6576588s - - 12899127544657658800ns149295 10:59:04.6576588s - - 149295 10:59:04.6576588s149295 10:59:04.6576588s - | RoundtripDelay: 000ns (0s)149295 10:59:04.6576588s - | LocalClockOffset: -74347030900ns - 1:14.347030900s149295 10:59:04.6576588s - \--149295 10:59:04.6576588s - Response received from domain controller hilldc1.pilotcat.com authenticated successfully.149295 10:59:04.6576588s - Peer poll: Max:16384.0000000s Cur:16384.0000000s149295 10:59:04.6576588s - Response from peer hilldc1.pilotcat.com (ntp.d|192.168.1.53:123->192.168.1.55:123), ofs: -74.3470309s149295 10:59:04.6576588s - 5 Age:5 Ofs:-51.6857521s Dly:+00.0312500s RDly:+00.1093445s Dsp:01.3479588s RDsp:00.1182098s Dst:01.3635838s FDsp:08.0000000s149295 10:59:04.6576588s - 4 Age:4 Ofs:+14.4161779s Dly:+00.0312500s RDly:+00.1093445s Dsp:01.1583287s RDsp:00.1479340s Dst:01.1739537s FDsp:12.0000000s149295 10:59:04.6576588s - 3 Age:3 Ofs:+08.9209141s Dly:+00.0312500s RDly:+00.1093445s Dsp:00.9687025s RDsp:00.1262665s Dst:00.9843275s FDsp:14.0000000s149295 10:59:04.6576588s - 2 Age:2 Ofs:+06.4491410s Dly:+00.0935490s RDly:+00.1093445s Dsp:00.5894446s RDsp:00.1269531s Dst:00.6362191s FDsp:15.0000000s149295 10:59:04.6576588s - 1 Age:1 Ofs:-82.9951917s Dly:+00.0312500s RDly:+00.1093445s Dsp:00.2101860s RDsp:00.1312103s Dst:00.2258110s FDsp:11.8240804s149295 10:59:04.6576588s - 0 Age:0 Ofs:-74.3470309s Dly:+00.0312500s RDly:+00.1093445s Dsp:00.0312172s RDsp:00.1425323s Dst:00.0468422s FDsp:05.9120402s149295 10:59:04.6576588s - W32TmServiceMain: resync req, irreg now pending.149295 10:59:04.6576588s - W32TmServiceMain: waiting i0.000s (921.090s)149295 10:59:04.6576588s - W32TmServiceMain: timeout149295 10:59:04.6576588s - TimeProvCommand([NtpClient], TPC_GetSamples) called.149295 10:59:04.6576588s - NtpClient returned 1 samples.149295 10:59:04.6576588s - Sample 0 offset:-74.3470309s delay:+00.1405945s dispersion:06.0857897s149295 10:59:04.6576588s - Intersection successful with 0 dropped samples.149295 10:59:04.6576588s - 0: Sample:0 SyncDist:541560869 SelectDisp:0149295 10:59:04.6576588s - Sample 0 chosen. Select Dispersion:00.0000000s149295 10:59:04.6576588s - ClockDispln:ClockDispln Update: SO:-743470309 KPhO:17831 *PhO:-743488140 uT:991708 SD:58617867 (i) LI:0 S:4 RDl:1405945 RDs:804346037 TSF:0x2 Spike->Unset149295 10:59:04.6576588s - PhCRA:0 phcT:12508 KPhO:17831149295 10:59:04.6576588s - Logging warning: The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The system clock is unsynchronized. This is usually caused by synchronizing from low-accuracy time sources, or by poor network conditions.149295 10:59:04.6576588s - W32TmServiceMain: waiting 16384.000sDavid D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator

These ones may also help.http://support.microsoft.com/kb/884776/http://technet.microsoft.com/en-us/library/cc773061(WS.10).aspxRegards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect

I have checked all of my settings and from what I can tell the server is setup correctly to recieve time from the domain. I have also review the links and cannot find any issues. Do you have Ryans email? Or do you know how I can get a Microsoft rep to open a working group so I can upload the log file for review?David D. Ditto, Jr. Managed Services / Junior Technician MCP, MCDST, N-Able Certified Administrator

Its on his blog home page here.http://blogs.msdn.com/w32time/default.aspxRegards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect