Cannot Sync Time in Windows 10: w32tm/resync responds with Access Denied

The "Access Denied" error when running w32tm /resync in Windows 10 typically occurs because the command requires elevated administrative privileges, or the Windows Time service is not configured to allow manual synchronization requests. To resolve this issue, you must open Command Prompt as an administrator and ensure the underlying time service is correctly configured to accept external sync commands rather than rejecting them due to permission restrictions or service state conflicts.

Understanding the Error Context

When you encounter the message "Access Denied" while attempting to force a time synchronization using the Windows Time Service tool (w32tm), it indicates that the system is blocking the operation. This is rarely a network connectivity issue, such as the "Timed Waiting for Connection" errors seen in other scenarios, but rather a local security or configuration barrier. The w32tm utility interacts directly with the Windows Time service (W32Time) to query status, change settings, or force a resynchronization. If the process does not have the necessary token permissions, or if the service itself is in a locked state, the operating system returns an access violation. It is important to distinguish this from general file permission issues where another process holds a lock on a resource. While file locks can prevent certain updates, the time sync error is specifically tied to the execution context of the command line tool and the service configuration. Ignoring this distinction often leads users down the wrong troubleshooting path, checking firewall rules or NTP server availability before addressing the root cause: privilege elevation and service configuration.

Step 1: Run Command Prompt as Administrator

The most common reason for this specific error is executing the command from a standard user-level console. Even if your account has administrative rights, the default Command Prompt window runs with limited tokens. You must explicitly elevate the session to gain the necessary access to interact with system services. 1. Click the Start button or press the Windows key. 2. Type cmd in the search bar. 3. Right-click on Command Prompt in the results list. 4. Select Run as administrator from the context menu. 5. If prompted by User Account Control (UAC), click Yes to allow the app to make changes. Once the elevated window is open, try running the command again:

w32tm /resync

If the service is healthy and properly configured, this should now return "The command completed successfully." If it still fails, proceed to the next steps to check the service configuration.

Step 2: Verify and Restart the Windows Time Service

Sometimes the Windows Time service may be stuck in a stopped state, disabled, or misconfigured. Before forcing a resync, ensure the service is active and set to start automatically. 1. Press Windows + R to open the Run dialog. 2. Type services.msc and press Enter. 3. Locate Windows Time in the list of services. 4. Check the Status column; it should say "Running". If not, right-click and select Start. 5. Double-click Windows Time to open its properties. 6. Ensure Startup type is set to Automatic. 7. Click Apply and then OK. After restarting the service, attempt the resync command again in the elevated Command Prompt. If the service was previously disabled, enabling it may resolve the access denial immediately.

Step 3: Configure w32tm Settings Correctly

In some enterprise environments or customized systems, the Windows Time service is configured to ignore manual resync requests or to use a different NTP source that is unreachable. You can verify the current configuration and reset it to defaults if necessary. First, check the current configuration:

w32tm /query /configuration

Look for the Type field. If it is set to NoSync, the machine is not configured to sync with any external source. If it is set to NTP, ensure the specified server is reachable. To reset the configuration to the default Microsoft NTP pool:

w32tm /config /syncfromflags:manual /manualpeerlist:"time.windows.com" /update

After updating the configuration, restart the Windows Time service to apply the changes:

net stop w32time
net start w32time

Then, try the resync command one last time.

Step 4: Check Group Policy Restrictions

If you are on a domain-joined machine, Group Policy Objects (GPOs) may enforce time synchronization settings that override local configurations. In such cases, even running as an administrator might result in "Access Denied" if the GPO explicitly restricts the ability to modify time sources or force resyncs. Check the relevant policy by opening the Local Group Policy Editor (gpedit.msc) and navigating to: Computer Configuration > Administrative Templates > System > Windows Time Service > Time Providers Ensure that Enable Windows NTP Client is set to Not Configured or Enabled. If it is Disabled, the system will reject manual sync attempts. Note that on domain-joined machines, the Domain Controller usually acts as the time source, so manual NTP configuration may be ignored or blocked by policy.

Frequently Asked Questions

Why does w32tm fail with "The command completed successfully" but the time doesn't change?

This indicates that the resync command executed without error, but the time drift was too small to register a visible change, or the system clock was already accurate. It can also happen if the NTP server response was delayed. Wait a few minutes and check the time again, or increase the drift compensation setting.

How do I manually specify an NTP server in Windows 10?

You can specify a custom NTP server by running w32tm /config /syncfromflags:manual /manualpeerlist:"pool.ntp.org" /update in an elevated Command Prompt. After updating the configuration, restart the Windows Time service using net stop w32time followed by net start w32time.

Can antivirus software block w32tm resync operations?

While rare, some aggressive endpoint protection tools may intercept system service calls. If standard troubleshooting fails, temporarily disable third-party antivirus software and test the resync command. If it succeeds, add an exception for the Windows Time service or w32tm.exe in your security software settings.

What should I do if my computer is joined to a domain?

In a domain environment, Windows typically synchronizes time with the Primary Domain Controller (PDC) emulator, not an external NTP server. Manual NTP configuration may be overridden by Group Policy. Instead of forcing an NTP sync, ensure your domain controller is correctly syncing with an external time source, or consult your IT administrator for domain-specific time policies.

Is there a way to schedule automatic time sync checks?

Windows handles time synchronization automatically at regular intervals. You can adjust the frequency by modifying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\SpecialPollInterval. However, changing this value is generally unnecessary and may lead to increased network traffic or clock instability if set too low.