Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 29 Source: W32Time

Source
Level
Description
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.
Comments
 
See the information about this event in this article: EV100160.
I my case I noticed that the local w32time service was not synching with a DC. Eventually I found that the netlogon and w32time service was not running on the DC. After starting them, the log cleared up.
This behavior occurs when NTLM version 2 (NTLMv2) is used for authentication and when there is a time difference of more than 30 minutes between the local Windows XP computer and the remote Windows XP computer. See ME957009 for details on this situation.

If you work on a Microsoft Cluster Service (MSCS) cluster that is running Microsoft Windows Server 2003, the Windows Time service is working in NT5DS mode and one of the virtual groups in this cluster owns more than two virtual Internet Protocol (IP) addresses, you will see this event logged multiple times in the System event log. See ME914043 to solve this problem.
In my case, this problem was caused by the "AEGIS Protocol (IEEE 802.1x) v 3.4.3.0" driver that was probably installed together with the ASUS WLAN driver. This event occurred together with Event ID 14 from source W32Time, Event ID 5719 from source NETLOGON and Event ID 1054 from source Userenv. After disabling this item in the network card properties, all these errors were gone.
- Description: No valid response has been received from manually configured peer - In my case, I was not able to synchronize the PDC server, which was an NTP server as well, and all other clients were synchronizing their times according to this server.

Solution:
1. Set all servers in the domain to be synchronized by your PDC.

- nltest /dclist:domain
- for /f "tokens=1, *" %i in (servers.txt) do net time \\%i /setsntp:PDC-NTP-Server /y >> result.txt

The file servers.txt contains a list of your servers.

- net time /domain:domain name /set

2. Modify the registry to set the time server. Go to HKLM\System\CurrentControlSet\Services\lanmanserver\parameters and add a key TimeSource (reg_dword) with a value of 1.

3. This problem may occur when your computer sends synchronization requests by using symmetric active mode. By default, Windows Server 2003 domain controllers are configured as time servers and use symmetric active mode to send synchronization requests. Some NTP servers that do not run Windows respond only to requests that use client mode.
Click Start, click Run, type cmd, and then press Enter. At the command prompt, type the following commands in the order that they are given. After you type each command, press Enter:
• w32tm /config /manualpeerlist:NTP_server_IP_Address, 0x8 syncfromflags:MANUAL
• net stop w32time
• net start w32time
• w32tm /resync
See ME875424 for details.

After applying these steps, the problem should be solved.


The following fixed a rogue workstation for me. Run from the command line on the workstation.

To clear any entry and return to the default settings run “NET TIME /SETSNTP:”. Then run “NET TIME /SET /YES”. If this is OK then run “W32TM /monitor” to ensure that each member server/workstation is actually pointing to a DC. Finally, run “W32TM /resync /rediscover” followed by “W32TM /resync /nowait”.
For a list of Internet-based NTP servers see the US Navy Naval Observatory link below.

You may also receive this error if no domain controller is accessible (so the workstation is unable to syncronize its time).
1. Synchronize the computer with the DC.
2. You may want to setup NTP time. To setup the NTP time on the server use this command: Net Time /Setsntp:IP_Address or DNS name.
The Windows XP firewall blocks the updates as well. Make an exception for UDP port 123. We made an exception using Group policy. This is located under Administrative Templates -> Network -> Network Connections -> Windows Firewall -> Domain Profile -> Windows Firewall -> Define Port Exceptions. Use the Show button and then add 123:UDP:xxx.xxx.xxx.xxx/xx, xxx.xxx.xxx.xxx/xx:enabled:W32TM. Where the x's are your IP range, i.e.: 10.10.1.0/24, 10.10.10.0/24. You only need to set this for the Domain profile. The standard profile controls the firewall when not connected to your domain, so they could not synchronize with your DCs anyway.
I have a W2k3 server running DNS server that connects to another W2k3 server running as PDC on a NT4 domain. When this server first starts, I had this error, which followed an EventID 5790 from source NetLogon.
My problem was caused by NetLogon failing to start in time. Making NetLogon dependant on DNS cured this problem. Go to this key: “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon" and modify the “DependOnService” string adding DNS after LanmanWorkstation.

In another case, I had this problem with a W2K3 Server synchronizing with the DC. This problem appeared because the DC's Windows time service had been stopped and disabled.
See ME875424 for a solution to the time synchronization problem.
See ME216734 to find out how to configure an authoritative time server in Windows 2000, and ME314054 for Windows XP.

See the links to "Windows Time Service Technical Reference", "How to fix time synchronization errors", and "How to Synchronize SBS2003 Premium with an External Time Source" for additional information on this event.
If the NetLogon service is stopped and you are set to update your time from a DC, you will get this error. Make sure NetLogon is set to Automatic if your computer is part of a domain.
If you are behind a firewall, you may be blocked from accessing NTP services on the Internet. Use “net time /querysntp” and “net time /set” to test NTP access.


In my case, disconnecting the workstation from the problematic domain, connecting it to a different domain, and then reconnecting it to the original domain fixed this problem.
This error can also appear on Windows XP clients in conjunction with EventID 14 from source W32Time if the DC’s W32Time service is stopped or disabled.
If the OS on your DCs is Win2k3, this error on your client PCs may indicate a need to apple hotfix ME830092 to your Domain Controllers. Note that this patch has not been regression tested and is not indicated if you do not see Event ID 50 on your DCs. This event ID is often seen in combination with W32Time Event ID 24 (Warning).
This normally means that the computer lost connectivity to the PDC Emulator or SNTP server while it was trying to sync the time.  To update run net time command the syntax is below.

net time /setsntp:<sntp server ip address>

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...