w32tm /query /status Access is denied. (0x80070005) from elevated prompt‎

I am in the process of decomissioning the 2008 DC so I have moved all FSMO roles to another DC. The old DC is getting time from the newly promoted PDC as are the domain clients it seems.

I have gone through this below more times than I should have needed, the info is clear and it seems to work. however I still get an error from an elevated cmd prompt.

C:\Windows\System32>w32tm /query /status

or

C:\Windows\System32>w32tm /query /configuration

The following error occurred: Access is denied. (0x80070005)

pushd %SystemRoot%\system32
.\net stop w32time
.\w32tm /unregister
.\w32tm /register
.\sc config w32time type= own
.\net start w32time
.\w32tm /config /update /manualpeerlist:"0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org",0x8 /syncfromflags:MANUAL /reliable:yes
.\w32tm /resync
popd

Why am I not able to run a query on the PDC with an elevated cmd prompt and I do have domain rights in all the right areas! I have never had this problem b

May 16th, 2013 9:37pm

If its not working with domain admin account then it can be issue with the virus/worm/malware. I have seen this issue in the past & it was due to infection in the system. The other angle is verifying windows in built firewall service might be the cause, try to disable it temporarily & see if it works. Verify the registry permission or use procmon to scan the permission on the registry.
Free Windows Admin Tool Kit Click here and download it now
May 17th, 2013 1:20am

Agree with Awinish, however I would suggest you to try manual changes through registry using below link.

support.microsoft.com/kb/816042

support.microsoft.com/kb/816042
  • Edited by VenkatSP Friday, May 17, 2013 3:55 AM
May 17th, 2013 3:54am

If its not working with domain admin account then it can be issue with the virus/worm/malware. I have seen this issue in the past & it was due to infection in the system. The other angle is verifying windows in built firewall service might be the cause, try to disable it temporarily & see if it works. Verify the registry permission or use procmon to scan the permission on the
Free Windows Admin Tool Kit Click here and download it now
May 17th, 2013 3:10pm

Agree with Awinish, however I would suggest you to try manual changes through registry using below link.

support.microsoft.com/kb/816042

support.microsoft.com/kb/816042

I will evaluate
May 17th, 2013 3:11pm

Hi,

Just want to confirm the current situation.

Have you check this KB article?

How to configure an authoritative time server in Windows Server

http://support.microsoft.com/kb/816042

If you have any feedback on our support, please click here

Regards.

Free Windows Admin Tool Kit Click here and download it now
May 21st, 2013 5:51am

Hi,

Just want to confirm the current situation.

Have you check this KB article?

How to configure an authoritative time server in Windows Server

http://support.microsoft.com/kb/816042

If you have any feedback on our support, please click here

Re

May 21st, 2013 4:49pm

You can simply uninstall time services & reconfigure the parameters. You can also enable time logging to see whats going on behind the scene.

- Type CMD in the run windows

-  Type Net stop w32time to stop the time service

-  Type W32tm /unregister to unregister the time service registry

-  Type W32tm /register to register the time service registry back

-  Type Net start w32time

Configuring a time source for the forest  http://technet.microsoft.com/en-us/library/cc784800%28WS.10%29.aspx

How to turn on debug logging in the Windows Time Service  http://support.microsoft.com/kb/816043

Windows Time Server Role in AD Forest/Domain

Free Windows Admin Tool Kit Click here and download it now
May 22nd, 2013 1:33am

Do you have any related errors in the event logs? Have you tried this:

Ensure that the Windows Time service can read its registry configuration settings

To ensure that the Windows Time service can read its registry configuration settings:

Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

  1. Open Registry Editor. To open Registry Editor, click Start. In Start Search, type regedit, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. Go to the Config key in the registry by expanding the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time.
  3. Right-click the Config key, and then click Permissions. The Permissions for Config dialog box opens.
  4. On the Security tab, under Group or user names, ensure that the W32Time account is listed.
  5. Click the Advanced button. The Advanced Security Settings for Config dialog box opens.
  6. Select the W32Time account in the list of permission entries.
  7. Click Edit. The Permission Entry for Config dialog box opens.
  8. In the Permission Entry for Config dialog box, ensure that W32Time has the following permissions selected in the Allow column: Query Value, Set Value, Create Subkey, Enumerate Subkeys, Notify, Delete, and ReadControl. If any of those permissions are not set to Allow, select the box next to the appropriate permission in the Allow column. Ensure that there is nothing selected in the Deny column.
  9. If you made any changes, click OK. Otherwise, click Cancel. The Permission Entry for Config dialog box closes.
  10. Click OK in the Advanced Security Settings for Config dialog box.
  11. Click OK in the Permissions for Config dialog box.

...from http://technet.microsoft.com/en-us/library/cc733213(v=ws.10).aspx

May 22nd, 2013 6:34am

You can simply uninstall time services & reconfigure the parameters. You can also enable time logging to see whats going on behind the scene.

- Type CMD in the run windows

-  Type Net stop w32time to stop the time service

-  Type W32tm /unregister to unregister the time service registry

-  Type W32tm /register to register the time service registry back

-  Type Net start w32time

Configuring a time source for the forest  http://technet.microsoft.com/en-us/library/cc784800%28WS.10%29.aspx

How to turn on debug logging in the Windows Time Service  http://support.microsoft.com/kb/816043

Windows Time Server Role in AD Forest/Domain

May 22nd, 2013 3:50pm

Do you have any related errors in the event logs? Have you tried this:

Ensure that the Windows Time service can read its registry configuration settings

To ensure that the Windows Time service can read its registry configuration settings:

Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

  1. Open Registry Editor. To open Registry Editor, click Start. In Start Search, type regedit, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. Go to the Config key in the registry by expanding the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time.
  3. Right-click the Config key, and then click Permissions. The Permissions for Config dialog box opens.
  4. On the Security tab, under Group or user names, ensure that the W32Time account is listed.
  5. Click the Advanced button. The Advanced Security Settings for Config dialog box opens.
  6. Select the W32Time account in the list of permission entries.
  7. Click Edit. The Permission Entry for Config dialog box opens.
  8. In the Permission Entry for Config dialog box, ensure that W32Time has the following permissions selected in the Allow column: Query Value, Set Value, Create Subkey, Enumerate Subkeys, Notify, Delete, and ReadControl. If any of those permissions are not set to Allow, select the box next to the appropriate permission in the Allow column. Ensure that there is nothing selected in the Deny column.
  9. If you made any changes, click OK. Otherwise, click Cancel. The Permission Entry for Config dialog box closes.
  10. Click OK in the Advanced Security Settings for Config dialog box.
  11. Click OK in the Permissions for Config dialog box.

I checked everything and it was identical! I tried rerunning the cmd w32tm /query /configuration and the same error, very frustrating.

The following error occurred: Access is denied. (0x80070005)

May 22nd, 2013 7:11pm

Hi,

Please also check the similar thread:

w32tm Access is denied. (0x80070005) from elevated prompt        

http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/9bdfc2cc-4775-4435-8868-57d214e1e3ba

If you have any feedback on our support, please click here

Regards.

Free Windows Admin Tool Kit Click here and download it now
May 23rd, 2013 7:14am

Hi,

Please also check the similar thread:

w32tm Access is denied. (0x80070005) from elevated prompt        

http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/9bdfc2cc-4775-4435-8868-57d214e1e3ba

Regards.

May 23rd, 2013 4:24pm

Hi,

Have you seen any error related to W32TM in the event log? Also, please try to boot the sever into safe mode with network and then verify if this issue happens again.

Free Windows Admin Tool Kit Click here and download it now
May 24th, 2013 9:17am

Hi,

Have you seen any error related to W32TM in the event log? Also, please try to boot the sever into safe mode with network and then verify if this issue happens ag

May 29th, 2013 7:02pm

I thought that by changing the w32time to a shared process it would work, no if failed to start.

C:\Windows\System32>.\net stop w32time
The Windows Time service is stopping.
The Windows Time service was stopped successfully.


C:\Windows\System32>.\sc config w32time type= share
[SC] ChangeServiceConfig SUCCESS

C:\Windows\System32>.\net start w32time
System error 1290 has occurred.

The service start failed since one or more services in the same process have an incompatible service SID type setting. A service with restricted service SID type can only coexist in the same process with other services with a restricted SID type. If the service SID type for this service was just configured, the hosting process must be restarted in order to start this service.

Free Windows Admin Tool Kit Click here and download it now
May 29th, 2013 7:20pm

I changed the service back to own and it started.

C:\Windows\System32>.\sc config w32time type= own
[SC] ChangeServiceConfig SUCCESS

C:\Windows\System32>.\net start w32time
The Windows Time service is starting.
The Windows Time service was started successfully.

May 29th, 2013 7:22pm

Did you try running a sfc /scannow?

Also I would try exporting the win32tm reg key from a working computer and importing it. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time

Free Windows Admin Tool Kit Click here and download it now
May 30th, 2013 5:45pm

Did you try running a sfc /scannow?

Also I would try exporting the win32tm reg key from a working computer and importing it. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W

May 30th, 2013 11:20pm

Hi,

We may need  more logs to troubleshoot this issue, so please create a case to MS support team. They will help you solve this issue.

Free Windows Admin Tool Kit Click here and download it now
May 31st, 2013 11:12am

 please create a case to MS support team. They will help you solve this is

June 20th, 2013 3:47pm

HI,

It requires your SA agreement, so it needs you pay if you don't have SA agreement. 

Free Windows Admin Tool Kit Click here and download it now
June 21st, 2013 1:36am

HI,

It requires your SA agreement, so it needs you pay if you don't have SA agreement.

June 21st, 2013 1:52am

Anyone else having this problem and unable to resolve it?  I've tried all of the recommended solutions listed in this thread (as well as the other threads that are linked from this one) and cannot query w32time using w32tm.exe whatsoever.  I continually get the "Access is denied. (0x80070005)" error.  I can verify from the Event Viewer that the service is, in fact, running properly and querying AD for a domain controller to sync time with, but without the use of w32tm.exe, I have no way of querying the service to see what it is doing.  This is happening on two different physical WS08R2 boxes.  Thoughts?
Free Windows Admin Tool Kit Click here and download it now
August 19th, 2013 8:00pm

Anyone else having this problem and unable to resolve it?  I've tried all of the recommended solutions listed in this thread (as well as the other threads that are linked from this one) and cannot query w32time using w32tm.exe whatsoever.  I continually get the "Access is denied. (0x80070005)" error.  I can verify from the Event Viewer that the service is, in fact, running properly and querying AD for a domain controller to sync time with, but without the use of w32tm.exe, I have no way of querying the service to see what it is doing.  This is happening on two different physical WS08R2 boxes.  Thoughts?

I'd sure like to know what the fix is, this seems dead in that no one is paying any attention to it.
August 19th, 2013 8:02pm

FWIW, these are both non domain controllers that are members of the same domain.

We recently made widespread time changes by removing a GPO that was manually pointing all domain members (including DCs) to a local NTP appliance (against MS best practices), and instead, allowing w32time to query AD find the appropriate time provider.  This has been a really painstaking task -- with a lot of these systems, w32time does not want to "forget" the original/manually configured NTP source.  It has required everything from w32tm /config /syncfromflags:domhier /update to w32tm /unregister then /register to flush out the old settings entirely, and allow the service to do what it's supposed to do.

Everyone seems to suggest the sc config procedure, repeating the /unregister /register steps, rebooting, and checking the registry permissions, all unsuccessfully.  Some folks start suggesting commands to run within w32tm.exe, which I believe to be down the wrong path -- the logical configuration of our time is correct now (and the event 35 from the time system confirms this) -- this is simply the ability to use the diagnostic w32tm.exe tool.

Free Windows Admin Tool Kit Click here and download it now
August 19th, 2013 8:13pm

I believe that running w32tm /unregister and then w32tm /register is what whacks it out and the rights are never correct again.
August 19th, 2013 8:28pm

In situations where w32time is being especially stubborn, I've had pretty good success with /unregister and then /register.  It seems that situations that necessitate the sc config step are those systems that are going to start showing the above behavior.  Honestly, I think that w32time is an after thought to MS -- by large it works the way it is supposed to, but when things start to get wonky, there's really no systematic way to troubleshooting the service itself (and I'm referring especially to the binaries for the w32time service itself - not necessarily the logical configuration that one should being using in their AD environment; thankfully, the best practices for that are very well explained and mostly understood by all).
Free Windows Admin Tool Kit Click here and download it now
August 19th, 2013 8:50pm

It has now happened to a fourth machine and I think I've found some repeatable behavior to report:

  1. These are all WS08R2.
  2. On at least two of these boxes, after a reboot, the Windows Time service has disappeared altogether.  Just gone.
  3. I run w32tm /register which causes the service to be created.
  4. I try net start w32time and get this result: System error 1290 has occurred.  The service start failed since one or more services in the same process have an incompatible service SID type setting. A service with restricted service SID type can only coexist in the same process with other services with a restricted SID type. If the service SID type for this service was just configured, the hosting process must be restarted in order to start this service.
  5. I run sc config w32time type= own, which completes successfully: [SC] ChangeServiceConfig SUCCESS
  6. Then I net start w32time, and the service starts OK.  I get an Information event 37 followed by a 35 from Time-Service, indicating that w32time has found a time source in AD and is now sync'ing,
  7. But when I use w32tm to do something like w32tm /query /status, I get: The following error occurred: Access is denied. (0x80070005)

I can't explain it.  The time service is actually working, but I can't do a whole lot to troubleshoot with it.  Interestingly, however, a command like /stripchart does work, but anything having to do with /query gives me the aforementioned access denied error.

August 20th, 2013 4:59pm

I found similar and when I ran sc config w32time type= own the service really does not want to be set to own, it wants to be set to shared but it won't run that way either.
Free Windows Admin Tool Kit Click here and download it now
August 20th, 2013 5:03pm

I found similar and when I ran sc config w32time type= own the service really does not want to be set to own, it wants to be set to shared but it won't run that way eith
August 20th, 2013 5:23pm

This is where I found my deadend, it doesn't run properly when set to OWN as I believe you can't run a query against it but when SHARED it didn't run at all if memory
Free Windows Admin Tool Kit Click here and download it now
August 20th, 2013 6:03pm

Charlie -- give this a go when you have chance (all as administrator, of course):

  1. stop w32time
  2. w32tm /unregister
  3. reboot
  4. regsvr32 /u w32time.dll
  5. w32tm /register
  6. sc query w32time -- you should see that the service is set to shared mode -- this is presumably how it should be -- if you try to start right now, you'll get the expected 1290 SID-related error
  7. reboot
  8. w32time should now automatically start at boot up and be running -- that was my result -- it's running as shared, started on its own, and I can do the w32tm /query commands successfully
August 20th, 2013 6:39pm

Charlie -- give this a go when you have chance (all as administrator, of course):

  1. stop w32time
  2. w32tm /unregister
  3. reboot
  4. regsvr32 /u w32time.dll
  5. w32tm /register
  6. sc query w32time -- you should see that the service is set to shared mode -- this is presumably how it should be -- if you try to start right now, you'll get the expected 1290 SID-related error
  7. reboot
  8. w32time should now automatically start at boot up and be running -- that was my result -- it's running as shared, started on its own, and I can do the w32tm /query commands successfully

I swear I've rebooted after running it as shared but then again it's been a while. I can't do this for a few days but will within a day or two. If this is the case you get the fix and perhaps it will help someone else someday as MS surely has not suggested how to address this.
Free Windows Admin Tool Kit Click here and download it now
August 20th, 2013 7:08pm

Please do.  I just tried it on the second machine that was having issues and it fixed the problem.  One notable thing is that if you try running step #4 before #3, you'll get an error about unregistering the DLL....so I'm thinking that the w32tm /unregister step is not able to fully complete w/o a reboot first.

August 20th, 2013 7:38pm

Charlie -- give this a go when you have chance (all as administrator, of course):

  1. stop w32time
  2. w32tm /unregister
  3. reboot
  4. regsvr32 /u w32time.dll
  5. w32tm /register
  6. sc query w32time -- you should see that the service is set to shared mode -- this is presumably how it should be -- if you try to start right now, you'll get the expected 1290 SID-related error
  7. reboot
  8. w32time should now automatically start at boot up and be running -- that was my result -- it's running as shared, started on its own, and I can do the w32tm /query commands successfully

Thanks for this Ben, fixed the problem for me.

dave

Free Windows Admin Tool Kit Click here and download it now
September 6th, 2013 10:05am

Hey,

this works for me... thanks

Vaibahv

October 22nd, 2013 12:51pm

Many Thanks Ben,

Special thanks to CJ for posting this problem that has plagued me for over a year.

Ben, your solution is the missing piece to this puzzle.

Many thanks to both of you.

Raul

Free Windows Admin Tool Kit Click here and download it now
February 24th, 2014 8:24pm

Similar issues here.
I had a damaged registry key somewhere under w32tm, so manually deleting the whole key allowed me to re-register with w32tm /register and rebuild the key

second issue was my GPO - i'd set up the domain to come to the PDC for time, but forgot to make sure the PDC didn't come to itself. In the end, i needed to make a new group with every machine but the PDC in it and apply the GPO to that group only, via security filtering. GPO scope could really do with an 'exclude' option...
April 22nd, 2015 9:50pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics