Windows Server · Windows · critical · Roles & shared services

Time is wrong across the domain — w32time events 129, 36, 47

Kerberos refuses tickets outside a five-minute skew, so time drift presents as authentication failures rather than as a clock problem.

What you see

Sign-ins fail, scheduled tasks misfire, certificates appear invalid. Events 129 or 36 from Time-Service. Often only noticed when something else breaks.

What is actually wrong

The PDC emulator is not synchronised to an external source, a virtualised DC is taking time from its host as well as from the domain, or the hierarchy is broken so DCs sync from each other in a loop.

Codes and articles

Event 129Event 36Event 47Event 50w32time0x800705B4time skew

Fixes (2)

Point the PDC emulator at a real external source

Elevated PowerShell on the PDC emulator25 minutesmedium riskreversible

The whole domain's time comes from this one machine, so this is where to start.

Confirm which DC actually holds the role.
PowerShell
```
Get-ADDomain | Select-Object PDCEmulator
```
Look at the current configuration and source.
PowerShell
```
w32tm /query /status /verbosew32tm /query /configuration
```
Configure it to take time from external NTP servers.
Command Prompt
```
w32tm /config /manualpeerlist:"time.windows.com,0x8 uk.pool.ntp.org,0x8" /syncfromflags:manual /reliable:yes /update
```
0x8 means send as a client in normal mode. /reliable:yes marks this machine as the authority the rest of the domain trusts.
Restart the service and force a resync.
Command Prompt
```
Restart-Service w32timew32tm /resync /rediscover
```
If the DC is a Hyper-V guest, disable the host time synchronisation integration service — two authorities fight and neither wins.
PowerShell
```
Disable-VMIntegrationService -VMName DC01 -Name 'Time Synchronization'
```
Run this on the Hyper-V host. A virtualised PDC taking time from both its host and NTP oscillates, and the resulting skew is intermittent and maddening to trace.
Check the outbound path — UDP 123 has to be open to the internet or to an internal appliance.
PowerShell
```
Test-NetConnection -ComputerName uk.pool.ntp.org -Port 123 -InformationLevel Detailed
```

Confirm it workedThe source is the external server and the offset is small.

Command Prompt

w32tm /query /sourcew32tm /query /status | findstr /i "offset source stratum"

If you need to undo itw32tm /config /syncfromflags:domhier /update returns it to domain hierarchy, then restart w32time.

Put a member back on the domain hierarchy

Elevated PowerShell on the affected machine20 minuteslow riskreversible

A DC or member server has drifted while the PDC emulator is correct.

Check where it is currently taking time from.
Command Prompt
```
w32tm /query /sourcew32tm /query /status
```
Reset the service to its defaults and re-register it — this clears a corrupt configuration in one step.
Command Prompt
```
net stop w32timew32tm /unregisterw32tm /registernet start w32time
```

Set it back to the domain hierarchy.

Command Prompt

w32tm /config /syncfromflags:domhier /updateRestart-Service w32timew32tm /resync

On a Hyper-V guest, disable host time sync as above so only one source is in play.
Confirm it now follows a DC.
Command Prompt
```
w32tm /query /source
```

Confirm it workedThe source is a domain controller and the offset is under a second.

Command Prompt

w32tm /monitor

If you need to undo itNone — this restores the default configuration.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.