Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 17 Source: W32Time

Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer ",0x1". NtpClient will try the DNS lookup again in 60 minutes. The error was: <error message>. (<error code>)
This error mean that the computer can't contact the configured Network Time Protocol(NTP) source. From a cmd prompt run

net time

to see what the NTP source is. You can run

net time /setsntp IPADDRESS

to configure a new net time provider, or uncheck "Automatically update time..." in the Date/Time properties to prevent the system from attempting to syncronize it's time with external source.
This error is logged when the server is started. When the W32Time service is trying to communicate with an external time source ( or another one), DNS is not fully started and cannot resolve the name into an IP address. To solve this, make W32Time dependent on DNS:
1. open regedit
2. go to HKLM\System\CurrentControlSet\Services\W32Time
3. add a Multi-String value (REG_MULTI_SZ) named DependOnService
4. edit the value and put DNS in it.
- Error message: "No such service is known. The service cannot be found in the specified name space", error code: 0x8007277C - This event is seen if the Log On for the Windows Time Service is changed from Local System Account to NT AUTHORITY\LocalService. The path to execute the service should be “C:\WINDOWS\System32\svchost.exe -k netsvcs” instead of “C:\WINDOWS\system32\svchost.exe -k LocalService”. To resolve this problem, open Services.msc from the Control Panel, double click Windows Time -> click on Log On. In the “Log on as” select Local System Account and make sure Allow service to interact with desktop in un-checked. Reboot the server and this error should disappear.
See MSW2KDB for information about this event.
I have seen this on a Windows 2003 server that is set both as the domains DNS server and NTP server.
This occurs on reboot, and then suceeds on the 15 min retry, looking at the logs it looks like the the NTP service attempts to resolve the DNS name to IP for the NTP external Server before DNS has fully loaded.

This may occur on a Windows XP machine when there is no Internet connectivity. The system tries to resolve the name of the time server but it fails.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.