Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 27 Source: W32Time

Source
Level
Description
Time Provider NtpClient: The response received from domain controller <host dns name> is missing the signature. The response may have been tampered with and will be ignored.
Comments
 
Your computer should be a member of a domain, and any responses from the domain controller should be signed (authenticated) by the domain controller. This event can indicate a security situation or that your computer is part of a domain and your account was deleted. See T756647 for additional information about this event.
I had the same issue for some time. It seems to be caused by a conflict in the configuration of a networked XP (or other) workstation on an MS Windows 2003 Server SP1 network. I simply did a “w32tm /resync /rediscover” to resolve the problem. This made the system flush out the manual entries and resynchronize with the PDC.
I had this problem on a Windows Server 2003 SP1 running Exchange 2003 SP2. Like Brent Knight, I unregistered w32tm, rebooted, registered w32tm and the error went away.
ME216734 provides information on how to configure an authoritative time server in Windows 2000.
This problem occurred on a Windows XP Professional system that was previously configured to use a specific SNTP server address (net time /setsntp:"tick.usno.navy.mil") and then joined to a local domain. The workstation apparently was still trying to update via previous settings. As opposed to un-registering the service I simply removed the configured settings with the command: net time /SETSNTP:””. Make sure to include an empty set of quotes. Then run: net time /query, and you should receive: "This computer is not currently configured to use a specific SNTP server". In my case, the workstation appears to have synchronized with the domain.


I got this error on a single WinXP machine on my network. All the other workstations were running W32Time without major problems. The only difference was that this was my own workstation and I had tried to configure the W32tm application manually.
To fix it, I unregistered the service (removing it from the system and the registry) using the command "w32tm /unregister" then restarted the machine. Run "w32tm /register" after reboot and check the service state (should be set to automatic, but start manually if necessary).
This does not get to the root of the problem (probably some misconfiguration of W32tm), but so far I've had no more problems.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...