Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 12 Source: W32Time

Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.
See ME314054 for information on how to configure an authoritative time server in Windows XP.
This event will occur on a domain controller. What is says is that while all the other computers are using a higher "authority" to synchronize their time (that is the domain controller), the controller itself does not have anyone higher to adjust its clock. So, in order to keep an accurate time, the NTP client on the controller itself should be configured to verify its clock against an external source (on the Internet for example). The event id 12 is just a reminder that the controller is not synchronized so its time cannot really be trusted. ME262680 provides a list of public NTP servers.
I had this same issue and my Domain Controller’s time was 6-7 minutes ahead. I tried all the MSKB articles mentioned and was still unable to synchronize the time. What eventually solved it, was changing the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\NtpServer setting to a reachable address ( did not work). I used the address of our Cisco router configured to synchronize with a government time source, then added “, 0x8” to make it a client of the NTP server. In addition, I had to disable the settings in the Default Domain Policy -> Computer Config -> Admin Templates -> System -> Windows Time Service -> Time Providers by setting all three values to “Not Configured”. Only this allowed me to use an external time source for my PDC emulator.
I ran into this problem when I moved my authoritative domain time server from a W2k server to a W2k3 server. Eventually, I found out that I had to use the IP Address for the NTP server setting instead of the DNS Address. So, instead of setting HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\NtpServer to ", 0x1", I had to use After making that change, it worked fine. I tested this on 4 W2k3 PDCs with the same results.
See the link to "Configuring Windows Time Service" for information on resolving this problem.

ME816042 provides information on how to configure an Authoritative Time Server on Server 2003.
ME305135 provides information on how to configure an Authoritative Time Server.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.