Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 22 Source: W32Time

The time provider NtpServer encountered an error while digitally signing the  NTP response for peer <IP>:<port>. NtpServer cannot provide secure (signed) time to the client and will ignore the request. The error was: <error>. (<error code>)
As per Microsoft: "The NTP server cannot provide an authenticated NTP package either because the client is not in the domain and the server cannot send the package or because the client is in the correct domain but a domain controller has not replicated the database yet". See MSW2KDB for more details.

- Error code: 0x80070525, error details: "The specified user does not exist" - No information.

ME816043 shows how to turn on debug logging in the Windows Time Service. If you are an administrator, you can use the debug logging feature of the Windows Time service to help troubleshoot issues.

From a newsgroup post: "When running a cluster in a Windows 2000 domain, you should remove the Cluster Time resource and associated time service. See ME279005 for detail on this issue".

From a newsgroup post: "I just finished debugging an issue similar to this. Our administrators were disabling domain machine accounts in AD, but leaving the machines on the network and the machines were trying to time sync with the AD. The AD cannot sign an encrypted ticket to complete the request and logs this error into the event viewer. Any type of situation where the Time Server no longer trusts the Windows Time service could cause this type of problem".
- Error code: 0x80070525, error details: "The specified user does not exist" - In one case this event ID appeared on a Windows 2003 SP1 domain controller each time a Windows XP SP2 computer was started. This computer could ping the domain controller but not vice versa. When the Windows XP Firewall was disabled and the computer was removed and re-joined to the domain, this event stopped.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.