Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 12 Source: Microsoft-Windows-Time-Service

Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the PDC emulator for the domain at the root of the forest. There is no machine above this machine in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure this PDC emulator in the root domain to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.
We fixed this by running the following commands on the domain controller:

1. net stop w32time

2. w32tm /config /syncfromflags:manual /manualpeerlist:",,,"

3. w32tm /config /reliable:yes

4. net start w32time
There is a Microsoft FIX IT that will set this up for you on Server 2012, 2008, and 2003. It's the second Fit It: Configuring the Windows Time service to use an external time source. See ME816042.
T756545 suggests that the computer should be manually configured to use an external time source. See the link for details.

This event is similar with event id 12 from W32Time (recorded on Windows 2000, XP, and 2003). Please see the link below.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.