Windows Time Service logs

Hi,
I am trying to find out if there is a way to see the activity of Windows Time Service? To be more specific -  time corrections (if any) has occurred in particular date and time.  

Thanks.
scripunAsked:
Who is Participating?
 
Gerwin Jansen, EE MVETopic Advisor Commented:
Hi, according to MS, you can setup logging, described here. I didn't test this personally though.
0
 
LHFoodsCommented:
You can view some activity in the System Event Log of the machine in question.  To see detailed info you will probably have to change the logging parameters for the w32tm service.
0
 
abhijitwaikarCommented:
Hi,

Time synch plays important role in AD environment, You have provided very short info about your AD environment, server & workstations.

am trying to find out if there is a way to see the activity of Windows Time Service?
Go to event log> system and filter events by w32time source.

PDC emulator role owner's time service should be sync with external time source and all other members should be sync with it.

First of all find out which server is holding PDC Emulator Role by typing "netdom query fsmo"

Once you have find out the PDC role holder server ,Configure PDC role server with External Time Source

How to configure an authoritative time server in Windows Server
http://support.microsoft.com/kb/816042

To check if time sever is working fine give the command "w32tm /resync /rediscover" you will get one information Event in the Event viewer .

After Configuring PDC role server ,configure other member server /workstations in the site to sync the Time with PDC server role

So your Goal is

PDC Server Role :
-----------------------
NtpServer : time.windows.com,0x1
AnnounceFlags : 5
Type : NTP

Other Server & Clients Machine
------------------------------------------
NtpServer : Server name(PDC role holder),0x1 or IP address of PDC role holder server
AnnounceFlags : 10
Type : NT5DS

E.g : ntpserver : PDCservername,0x1 or (IP) xx.xx.xx.xx

Regards,
Abhijitw.
0
Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
Gerwin Jansen, EE MVETopic Advisor Commented:
The W32Time service is logging al its actions in the System Event log, correct.

There's no need to change any parameters, you can see what's happening just fine, just filter on the w32tm service.
0
 
scripunAuthor Commented:
@abhijitwaikar
Thanks. I am all good there. Good info though.
@gerwinjansen
I don't see any W32Time service logs there for some reason.
0
 
abhijitwaikarCommented:
Hi,

I don't see any W32Time service logs there for some reason.
Check the windows time service is started otherwise it does not generate w32time event. Aslo you can try to view by w32tm and net time commands.

Regards,
Abhijitw.

0
 
LHFoodsCommented:
@gerwinjansen
Successful w32time sync events are not logged by default.  Thus if the onle events you see are that
"The time service is now synchronizing the system time with the time source yourdc.yourdomain.com"
that typically means that the time synch is functioning properly.
0
 
LHFoodsCommented:
This site was pretty informative on logging successfull time changes:
http://www.stevebunting.org/udpd4n6/forensics/timechange.htm
0
 
scripunAuthor Commented:
@LHFoods
Thanks. It's still not clear to me if this will occur durring automatic time changes. I like to change w32time events to log more info. Is it posible?
0
 
scripunAuthor Commented:
@gerwinjansen
This should be good for what I need.
Thank you all.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.