Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 11 Source: w32time

Source
Level
Description
The NTP server did not respond
Comments
 
To check the time server settings use: “net time /querysntp”
To set a time server use: “net time /setsntp:{Server Address}”
To force update from the time server use:
net stop w32time
net start w32time

For a list of public time servers see www.boulder.nist.gov/timefreq.
This issue may occur if the Norton AntiVirus Auto-Protect service is running. See ME810402 for details on this problem.

See ME323621 for information about how to configure the Simple Network Time Protocol (SNTP) on ISA Server.

See ME223184 for details on the registry entries for the W32Time service.
This event usually occurs when there is not NTP (Network Time Protocol) server configured in the network. To see the currently configured time server use the following command:

net time /querysntp

If there is a time server configured, then there may be a firewall that stops the server reporting the error from conencting to the NTP server.
I found this event on a new W2K Advanced Server which I set up as a root domain controller of a new forest. I tried several internet time servers, but I always got the same warning. I found two articles at microsoft: ME224799 (Basic Operation of the Windows Time Service) and ME216734 (How to configure an Authoritative Wwindows Time Server.
I don't need a synchronisation with an external server, so I made two changes at HKLM\System\CurrentControlSet\Services\W32Time\Parameters:

new value      "ReliableTimeSource, REG_SZ, 1" and
alter value in "Type, REG_SZ, NoSync"

and the warning disappears in the event log. I know, it's only a workaround.
By default, the event log only records unsuccessful w32time events, not successful ones. Follow the instructions in Microsoft Knowledge Base article ME307937 to turn on sucessful time set event logging. What you will notice after you do this is that your PDC w32time is actually successful more times than not at synchronizing with the external server. The situations where it is not successful probably occur due to slow remote server response.


My server was behind a firewall and opening outbound port 123 for ntp solved the problem.
On some special cases, (if you host AD on computer paired with DNS) you may experience this error. It may be that the DNS service is not started at that time. This behaviour only occures when you specify a DNS name for net time /setsntp.
If your DC is behind a ISA server see ISA Server Forum link for solution.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...