Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 36 Source: W32Time

The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized.
This behavior occurs when NTLM version 2 (NTLMv2) is used for authentication and when there is a time difference of more than 30 minutes between the local Windows XP computer and the remote Windows XP computer. See ME957009 for details on this situation.
Mark Minasi's suggestion to reset the registry fixed this problem for me. As per Mark Minasi: "My XP desktop stopped synchronizing its time with the domain.  The Event Log kept showing that the desktop had not time-synced with any of my DCs in weeks.  That worried me because if my workstation's time drifted more than five minutes from the domain controllers' time then I would not be able to log on.  Once I was three minutes off, I figured it was time to figure out what had happened.

I tried to re-synchronize from the command line:

w32tm /resync

And got "the computer did not resync because no time data was available."  Ouch, that does not look good.  Then I realized that I had fixed my system's time server as an experiment rather than letting AD set it.  Some free time sync programs do that also, so many of you may be in this position.  I just cleared out HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters's "NtpServer" value entry, and then I restarted the Windows Time Service.  Sadly, no dice ... still no sync.  For some reason, if your domain does not find all of the Registry entries to be "just right, " then it will not sync with your system.  You can, thankfully, fix it with this command:

w32tm /config /syncfromflags:DOMHIER /update

Type that from a command line, and then restart Windows Time Service and retry the w32tm /resync or, better,

w32tm /resync /rediscover

A command that cleans out and rebuilds a few other Registry entries.  I had that problem with my XP box about a year ago; since then I have found these commands useful on a number of systems.  When workstations get more than five minutes out of sync with the DC, then they stop authenticating but they're not very forthcoming about the reason -- so when authentication's a problem then first look at DNS, and if that doesn't help then look at time!"

See the link to "Mark Minasi Windows Networking Tech Page Issue #34" for the original article.
See ME832936 for a hotfix applicable to Microsoft Windows XP.

As per Microsoft: "This problem occurs because there is a code bug in the Release Candidate 1 (RC1) release of Windows Server 2003. The problem is aggravated by network congestion, a high CPU load or a high network load, and synchronization from low accuracy time sources.  The problem has been resolved in post-RC1 builds of Windows Server 2003". See ME328621 for more details.

ME223184 gives information on the registry entries for the W32Time service.
ME816042 shows how to configure an authoritative time server in Windows Server 2003.

See the link to "The Windows Time Service" for general information on the windows time service.
On Windows XP machines with Internet time synchronization enabled, this error occurs when the machine could not connect to a time server to synchronize its clock.
Solution 1: Switch to a less busy time server in Date/Time properties.  For a list of internet time servers operated by NIST, visit
Solution 2: Synchronize the clock manually in Date/Time properties.
This warning occurs when there is no DC available for time synchronization (the default configured time source) or when the DC is NT4 (which doesn't have time service). Also when the computer is manually configured to use a time server (with net time /setsntp:<NTPserver>) but cannot get a good NTP time. For an isolated workstation and when time precision is not an issue, the time service may be safely stopped and will be no more warnings/errors. Please note that time is important when member of a W2K domain.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.