Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Time Provider NtpClient: The response received from domain controller <host dns name> is missing the signature. The response may have been tampered with and will be ignored.
|English: This information is only available to subscribers. An example of English, please!|
|Concepts to understand:|
What is the role of a DNS server?
Your computer should be a member of a domain, and any responses from the domain controller should be signed (authenticated) by the domain controller. This event can indicate a security situation or that your computer is part of a domain and your account was deleted. See T756647 for additional information about this event.
I had the same issue for some time. It seems to be caused by a conflict in the configuration of a networked XP (or other) workstation on an MS Windows 2003 Server SP1 network. I simply did a “w32tm /resync /rediscover” to resolve the problem. This made the system flush out the manual entries and resynchronize with the PDC.
I had this problem on a Windows Server 2003 SP1 running Exchange 2003 SP2. Like Brent Knight, I unregistered w32tm, rebooted, registered w32tm and the error went away.
ME216734 provides information on how to configure an authoritative time server in Windows 2000.
This problem occurred on a Windows XP Professional system that was previously configured to use a specific SNTP server address (net time /setsntp:"tick.usno.navy.mil") and then joined to a local domain. The workstation apparently was still trying to update via previous settings. As opposed to un-registering the service I simply removed the configured settings with the command: net time /SETSNTP:””. Make sure to include an empty set of quotes. Then run: net time /query, and you should receive: "This computer is not currently configured to use a specific SNTP server". In my case, the workstation appears to have synchronized with the domain.
I got this error on a single WinXP machine on my network. All the other workstations were running W32Time without major problems. The only difference was that this was my own workstation and I had tried to configure the W32tm application manually.
To fix it, I unregistered the service (removing it from the system and the registry) using the command "w32tm /unregister" then restarted the machine. Run "w32tm /register" after reboot and check the service state (should be set to automatic, but start manually if necessary).
This does not get to the root of the problem (probably some misconfiguration of W32tm), but so far I've had no more problems.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
|Custom search for *****: Google - Bing - Microsoft - Yahoo|
Send comments or solutions
- Notify me when updated