When I look at the w32tm registry values they do not agree with /query /configuration

[Geo Perkins]

Win2012r2 server is domain controller FSMO role PDCe using NTP and obtaining time from pool.ntp.org as expected. Question is about why the behavior differs from the configuration in the registry. Does w32tm /config not also update the registry? I realize that the PDCe should use NTP and obtain time from an external source. I also realize that member servers (and other DCs) should use NT5DS and obtain their time from the PDCe. This question is about the behavior of w32tm "/query /status" and "/config" and the resulting values stored in the registry.


Registry contains:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

NtpServer REG_SZ "time.windows.com,0x9"

Type REG_SZ "NT5DS"



Command Output:

C:\>w32tm /query /status /verbose
Leap Indicator: 0(no warning)
Stratum: 4 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0532852s
Root Dispersion: 0.0983969s
ReferenceId: 0x0CA79702 (source IP: 12.167.151.2)
Last Successful Sync Time: 2/18/2019 3:40:51 PM
Source: pool.ntp.org
Poll Interval: 10 (1024s)
Phase Offset: -0.0000697s
ClockRate: 0.0156253s
State Machine: 2 (Sync)
Time Source Flags: 0 (None)
Server Role: 64 (Time Service)
Last Sync Error: 0 (The command completed successfully.)
Time since Last Good Sync Time: 200.3997467s


IP 12.167.151.2 is an ntp.org time server hosted by sourcefire and is the expected result. The registry seems wrong. Why is the registry value not agreeing with the NTP behavior and w32tm /query result?


Thank you.

Continue reading...