Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 54 Source: w32time

The Windows Time Service was not able to find a Domain Controller. A time and date update was not possible.
We received this event along with Event ID 64 following an upgrade/replacement of our PDC. Finally looks like it is solved after checking the Windows Time Service on the PDC. It was not starting automatically since it had the wrong Log On rights. Check this and start up the service. The other servers and client computers should sync soon after this.
As per Microsoft: “These issues may occur if the Norton AntiVirus Auto-Protect service is running". See ME810402 for details on this problem.

ME223184 lists the registry entries that control aspects of the W32Time service.
Check DNS settings and network connectivity and then run “w32tm /resync /nowait”.
Windows 2000 computers are attempting to synchronize their time with a domain controller. If none is found this message is generated. The domain controller must run the w32time service. This service can be syncronized with an external source (ie.atomic clocks like the one maintained by Navy Observatory). A syncronized time is very important for Active Directory implemenations due to its distributed nature.

As per Microsoft: "This issue can occur because of repeated network issues or if the Time service has been unable to find a domain controller to synchronize with for a long time. To reduce network traffic, the Time service will wait 960 minutes before it tries again, and no synchronization takes place during this interval, even if network connectivity is restored after being in a disconnected state for an amount of time that is less than the synchronization interval."

I have seen this occuring on a newly configured domain controller that had its DNS settings pointing to external DNS servers. Since the server would try to find the Domain Controller quering a DNS server the query would  fail and this event recorded.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.