The recurring one-hour time drift on Windows Server 2016 is typically caused by the system clock losing synchronization with the domain hierarchy or hardware instability. Resolving this requires configuring the correct NTP sources and verifying that the Windows Time service operates without interference from third-party agents or corrupted registry keys.
Understanding the Event ID 13 Error
When administrators notice the system time regressing, they often encounterEvent ID 13 in the System log of the Event Viewer. This specific event indicates that the system clock has changed significantly, which can disrupt authentication protocols like Kerberos and cause replication failures across Active Directory domains. The symptom described, where the time shifts backward by exactly one hour every ten days, suggests a cumulative drift rather than a single catastrophic failure. This pattern often points to a misconfiguration in how the server synchronizes its internal hardware clock against an external authoritative source. If the server is part of a domain, it should ideally derive its time from the Domain Controller, which in turn syncs with reliable external Network Time Protocol (NTP) servers. Failure at any step in this chain can result in the observed drift.
Checking Domain Hierarchy Sync
For member servers, the default behavior is to synchronize with the Primary Domain Controller (PDC) Emulator role holder. You can verify the current synchronization status by opening PowerShell and running the commandw32tm /query /status. Examine the output for the Source field; it should display the name of your domain controller. If it shows an IP address or an external source unexpectedly, the configuration may have been manually overridden or corrupted. Additionally, check the Last Successful Sync Time to see when the last valid update occurred. A gap between this timestamp and the current time helps confirm whether the drift is continuous or intermittent.
Configuring the Windows Time Service Correctly
If the server is not syncing correctly with the domain, you must reset the Windows Time service configuration. Open an elevated Command Prompt and executew32tm /resync to force an immediate synchronization attempt. If this fails, you may need to re-register the service by running w32tm /unregister followed by w32tm /register. After re-registration, restart the service using net stop w32time and net start w32time. This process clears stale configurations and forces the service to read the registry settings afresh. It is crucial to ensure that the W32Time service is set to Automatic startup in the Services console to prevent manual stops from causing future drift.
Setting External NTP Sources for Domain Controllers
The PDC Emulator itself must be configured to use reliable external NTP servers if it is not already doing so. Use the commandw32tm /config /syncfromflags:manual /manualpeerlist:"pool.ntp.org,0 0.pool.ntp.org,0" on the PDC. Replace the peer list with providers suitable for your region, such as Microsoft’s own time servers or local ISP endpoints. After updating the configuration, run w32tm /config /update to apply the changes to the registry. Then, restart the time service on the PDC. Once the PDC stabilizes, member servers will automatically inherit the correct time source during their next sync cycle. This hierarchical approach ensures consistency across the entire infrastructure.
Investigating Hardware Clock Drift
In some cases, the issue is not software-related but stems from hardware degradation. The motherboard’s CMOS battery powers the real-time clock (RTC) when the server is powered off or experiences a power loss. If this battery is failing, the system time may drift rapidly or reset entirely. To test this, observe the time after a full shutdown and reboot. If the time jumps significantly upon boot, the RTC hardware is likely faulty. Replacing the CMOS battery is a straightforward physical maintenance task that can resolve persistent drift issues unrelated to network synchronization. Additionally, ensure that no other time management software, such as virtualization tools or monitoring agents, is interfering with the system clock. Virtual machines hosted on the server might also be causing conflicts if they are not configured to pass through the host’s time signals.Verifying Registry Integrity
Corrupted registry entries underHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time can cause erratic behavior. Compare the current values with a known good configuration from another healthy server. Pay special attention to the SpecialPollInterval value, which dictates how often the client checks for updates. For domain members, this is usually managed by group policy and should not be manually altered unless troubleshooting specific issues. If you suspect corruption, exporting the key from a working server and importing it into the affected machine can restore proper functionality. Always back up the registry before making changes to avoid accidental system instability.
Frequently Asked Questions
How do I force a time resync on Windows Server?
You can force an immediate resynchronization by running the command w32tm /resync in an elevated command prompt. This command instructs the Windows Time service to contact its configured source immediately rather than waiting for the scheduled interval.
Why does my server show Event ID 13 repeatedly?
Event ID 13 appears when the system clock changes by more than a few seconds, indicating a significant drift or correction. This often happens when a server loses connection to its time source or when the hardware clock behaves erratically due to low battery voltage.
Can third-party antivirus software affect system time?
Yes, some security suites include features that monitor file timestamps or integrity, which may interfere with the Windows Time service. Check your antivirus logs for any blocked processes related to w32time.exe and add an exclusion if necessary.
What is the best NTP source for Windows Servers?
Microsoft recommends using time.windows.com or time.nist.gov as primary sources. For enterprise environments, using multiple redundant NTP servers from different geographic regions improves reliability and reduces latency impact.
Does replacing the hard drive affect system time?
No, the system time is maintained by the motherboard’s CMOS battery and the operating system’s kernel, not the storage drive. However, if you are migrating data, ensure that the new drive’s partition table and system files are intact to avoid boot delays that might confuse time services. For related hardware migration issues, see Windows 10 not booting after replacing hard drive with SSD for older laptops.