How to Check NTP Server Windows: Complete Diagnostic Guide

A 5-minute clock drift on your domain controller can lock users out of email and break Kerberos authentication. I've seen it happen more times than I care to count—usually on a Monday morning, right when everyone's trying to log in. The good news? You can prevent this by mastering a few simple NTP checks. This guide walks you through every method to check NTP server Windows environments, from basic w32tm commands to automated PowerShell monitoring. Whether you're running Windows 10, 11, or Server 2025, you'll learn how to verify the network time protocol is working correctly—and what to do when it isn't.

Prerequisites: What You Need Before Checking NTP on Windows

Before you start running commands, let's make sure you have the right tools and permissions. Skipping this step is the #1 reason people hit confusing "Access Denied" errors.

Required Permissions and Tools

You'll need administrator privileges for most w32tm queries and any configuration changes. Right-click Command Prompt or PowerShell and select Run as administrator—if you see a UAC prompt, click Yes.

The built-in tools you'll use:

• Command Prompt (cmd.exe)
• PowerShell (more powerful for scripting and automation)
• Windows Time Service (W32Time) — the underlying service that handles NTP on Windows

For advanced diagnostics, tools like NTPTest (free, from the NTP Project) can provide deeper insights, but honestly, the built-in tools cover 95% of what you'll need.

Understanding the Windows Time Service Architecture

Here's the mental model you need: Windows Time Service (W32Time) is a lightweight NTP implementation. It's not a full-featured NTP daemon like ntpd on Linux—Microsoft designed it primarily for Active Directory authentication, not for high-precision timekeeping.

The service can operate in two modes:

• NTP client mode: The machine syncs its clock from an upstream time source
• NTP server mode: The machine provides time to other clients

By default, Windows machines are configured as NTP clients syncing from time.windows.com. In a domain environment, the hierarchy looks like this:

External NTP Source (time.windows.com)
        ↓
PDC Emulator (root of domain time)
        ↓
Other Domain Controllers
        ↓
Domain Members

The PDC (Primary Domain Controller) emulator is the authoritative time source for the domain. If its clock drifts, every machine in the domain drifts with it.

How to Check NTP Server Status Using w32tm Commands

The w32tm command-line tool is your primary diagnostic instrument. It's been around since Windows 2000 and remains the go-to method to check NTP server Windows configurations.

w32tm /query /status: Decoding the Output

Let's start with the most important command. Open an elevated Command Prompt and run:

w32tm /query /status

Here's a sample output from a Windows Server 2019 machine I manage:

Leap Indicator: 3(not synchronized)
Stratum: 2 (secondary reference - syncd by (S)NTP)
Precision: -23 (119.209ns per tick)
Root Delay: 0.0457763s
Root Dispersion: 0.0457763s
ReferenceId: 0x0A0A0A0A (source IP: 10.10.10.10)
Last Successful Sync Time: 10/15/2025 3:42:17 AM
Source: 10.10.10.10
Poll Interval: 6 (64s)

Let me break down the fields that matter:

w32tm /query /configuration: Verifying Current Settings

To see what NTP servers are actually configured, run:

w32tm /query /configuration

The output is verbose, but focus on these two lines:

NtpServer: time.windows.com,0x8
Type: NTP

The NtpServer value shows your time source. The ,0x8 suffix means the client uses symmetric active mode—that's normal. The Type value tells you the operation mode:

• NTP: Client syncs from an external source
• NoSync: The machine doesn't sync time at all (problem!)
• NT5DS: Domain hierarchy sync (normal for domain members)

If you see Type: NoSync, that explains why your clock is drifting. I've encountered this on freshly cloned VMs more times than I'd like to admit.

Using w32tm /stripchart to Test Connectivity and Offset

The /stripchart command is my favorite diagnostic tool. It tests connectivity to an NTP server and measures the time offset:

w32tm /stripchart /computer:time.windows.com /samples:5

Sample output:

Tracking time.windows.com [162.159.200.123].
The current time is 10/15/2025 3:45:12 AM (UTC).
05:45:12, +0.0156250s
05:45:13, +0.0156250s
05:45:14, +0.0156250s
05:45:15, +0.0156250s
05:45:16, +0.0156250s

The +0.0156250s value is the offset—how far your clock is from the server. Anything under 1 second is acceptable for most environments. If you see offsets in the tens of seconds, you have a problem.

Verify NTP Sync Windows: Advanced Checks with PowerShell and Event Logs

While w32tm gives you a snapshot, PowerShell and Event Logs give you history and automation capabilities.

PowerShell Scripts for NTP Verification

First, check that the Windows Time service is actually running:

Get-Service w32time

You want to see Status: Running. If it's stopped, that's your problem.

For a more detailed check, use this script to pull the last sync time and source:

$w32tmStatus = w32tm /query /status
$lastSync = ($w32tmStatus | Select-String "Last Successful Sync Time").ToString().Split(":")[1].Trim()
$source = ($w32tmStatus | Select-String "Source").ToString().Split(":")[1].Trim()
Write-Host "Last Sync: $lastSync" -ForegroundColor Green
Write-Host "Source: $source" -ForegroundColor Green

I use variations of this script on all my servers. It's simple, but it catches 90% of time sync issues before they become user-facing problems.

Checking System Event Log for Time Service Errors

The Event Viewer contains a treasure trove of time sync information. Navigate to:

Event Viewer > Applications and Services Logs > Microsoft > Windows > Time-Service > Operational

Here are the Event IDs you should know:

Fix NTP Server Not Syncing Windows: Common Errors and Solutions

When things go wrong—and they will—here's how to fix the most common issues.

Troubleshooting Error 0x80070005 (Access Denied)

This error appears when you try to reconfigure W32Time without proper permissions. The fix is straightforward:

1. Close the current Command Prompt

2. Right-click Command Prompt and select Run as administrator

3. Restart the time service:

   net stop w32time && net start w32time
   

If the error persists, check registry permissions:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time

Right-click the key, select Permissions, and ensure the SYSTEM account has Full Control. I've seen third-party security software lock down this key, causing exactly this error.

Firewall and Network Issues: Checking Port 123

NTP uses UDP port 123. If your firewall blocks it, sync fails silently. Here's how to test:

Test-NetConnection -ComputerName time.windows.com -Port 123

If TcpTestSucceeded returns False, your firewall is blocking the port. To allow NTP through Windows Defender Firewall:

netsh advfirewall firewall add rule name="NTP Outbound" dir=out protocol=UDP remoteport=123 action=allow

Note: This creates an outbound rule. If you're running an NTP server, you'll also need an inbound rule.

Resolving Time Offset Issues on Domain Controllers

Domain controllers have special considerations. I once helped a colleague whose secondary DC was 30 minutes slow—it had stopped syncing with the PDC and was slowly drifting. The fix was forcing an external sync:

w32tm /config /manualpeerlist:us.pool.ntp.org /syncfromflags:manual /update
net stop w32time && net start w32time
w32tm /resync

For virtualized DCs, there's an additional gotcha: the hypervisor's time sync can interfere with NTP. Disable time sync with the host in your hypervisor settings. In Hyper-V, this means unchecking "Time synchronization" in Integration Services. In VMware, disable "Time synchronization" in the VM's guest operating system settings.

Automate NTP Checks with PowerShell Scripts

Manual checks are fine for occasional troubleshooting, but for production environments, you need automation.

Building a Simple NTP Monitoring Script

Here's a script I use on my own servers. It checks NTP status, logs results, and sends an email alert if the offset exceeds a threshold:

$threshold = 1.0  # seconds
$logFile = "C:\Logs\ntp_monitor.log"
$smtpServer = "smtp.yourdomain.com"
$alertEmail = "admin@yourdomain.com"

$status = w32tm /query /status 2>$null

if ($LASTEXITCODE -ne 0) {
    $message = "ERROR: w32tm command failed. Time service may be stopped."
    Add-Content $logFile "$(Get-Date) - $message"
    Send-MailMessage -To $alertEmail -Subject "NTP Monitor Alert" -Body $message -SmtpServer $smtpServer
    exit 1
}

$stripchart = w32tm /stripchart /computer:time.windows.com /samples:3 2>$null
$offsetLine = $stripchart | Select-String "s$" | Select-Object -Last 1
$offset = [math]::Abs([double]($offsetLine.ToString().Split(",")[1].Replace("s","").Trim()))

$logEntry = "$(Get-Date) - Offset: ${offset}s"
Add-Content $logFile $logEntry

if ($offset -gt $threshold) {
    $message = "WARNING: NTP offset is ${offset}s (threshold: ${threshold}s)"
    Send-MailMessage -To $alertEmail -Subject "NTP Monitor Alert" -Body $message -SmtpServer $smtpServer
}

Schedule this with Task Scheduler to run every 15 minutes, and you'll catch sync issues before users notice.

Windows 11 vs Windows Server 2025: NTP Command Differences

Good news: the core w32tm commands haven't changed dramatically across versions. But there are some differences worth noting.

Feature and Syntax Variations Across Versions

One notable change in Windows 11: the Settings app now shows NTP status in Settings > Time & Language > Date & Time. It's a nice GUI addition, but for real diagnostics, you'll still want the command line.

FAQ

How do I test if an NTP server is working in Windows?

Run w32tm /stripchart /computer:your-ntp-server /samples:5 from an elevated Command Prompt. If the server responds, you'll see offset values (e.g., +0.0156250s). An offset under 1 second means the server is working correctly. If you get a timeout or error, the server is unreachable or not responding.

Is 8.8.8.8 an NTP server?

No. 8.8.8.8 is Google's public DNS server, not an NTP server. For public time sources, use time.google.com (Google's NTP service) or servers from the pool.ntp.org project. Using a DNS server as an NTP source will fail silently—your clock just won't sync.

Does Windows have a built-in NTP server?

Yes, but with caveats. The Windows Time Service (W32Time) can act as an NTP server, but it's not a full-featured implementation. It's sufficient for domain environments but lacks the precision and features of dedicated NTP daemons. To enable it, set the Type registry value to NTP under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters and configure NtpServer with your upstream sources.

Why is my Windows NTP client not syncing?

Common causes include: firewall blocking UDP port 123, incorrect time zone settings, the w32time service being stopped, or registry misconfiguration. Start with these diagnostic commands:

w32tm /query /status
w32tm /query /configuration
Test-NetConnection -ComputerName time.windows.com -Port 123

Conclusion

Checking NTP server Windows configurations doesn't have to be a mystery. The w32tm commands, PowerShell scripts, and Event Log checks we've covered give you a complete diagnostic toolkit—from quick status checks to automated monitoring.

Regular NTP health checks are like checking your car's oil: skip them, and you'll eventually face a breakdown at the worst possible moment. In my experience, a few minutes of proactive monitoring saves hours of emergency troubleshooting.

Start by running w32tm /query /status on your critical servers today. Then implement the PowerShell monitoring script to catch issues before they affect your users. Your future self—and your users—will thank you.

Download our free PowerShell NTP monitoring script template and start automating your time sync checks today.