How do I troubleshoot time issues with my EC2 Windows instance?

Resolution

It's a best practice to use Coordinated Universal Time (UTC) for your instances to synchronize your Amazon CloudWatch logs, metrics, local logs, and other services. However, you can also use a different time zone.

Can't use System Settings or the Control Panel to change the time

Amazon provides the Amazon Time Sync Service. Amazon Time Sync Service is accessible from all EC2 instances. If you can't change the time settings, then use the command prompt window to configure the Amazon Time Sync Service on your instance.

To verify that Prohibit access to Control Panel and PC settings policy is turned off in the Local Group Policy Editor, complete the following steps:

1. Open the Local Group Policy Editor.
2. Select User Configuration, select Administrative Templates, and then select Control Panel.
3. Highlight Prohibit access to Control Panel and PC settings, and then select Edit policy setting.
4. Select Disabled.

Use command prompt to change the time zone

After you verify the policy setting, you can change the time zone from the command prompt window. For instructions, see the Windows tab of Change the time zone of your instance.

To update the time and date settings, complete the following steps:

1. Run a command prompt window as Administrator.
2. Enter time or date in the command prompt window, and then select OK.
3. Enter the new time or date at the prompt:
   Enter a new time in HH:MM:SS AM/PM format. For example, 08:35:00 AM.
   Enter a new date in mm-dd-yyyy format. For example, 01-01-2021.

The new time and date settings immediately take effect.

Note: The Citrix Xen Guest Agent service might cause issues with time synchronization. It's a best practice to update Citrix PV drivers to Amazon PV drivers.

After the system reboots, the time change doesn't persist

If you use Windows Server 2008 or later and you want to make the new time persist after reboot, add a RealTimeIsUniversal registry key. For instructions, see the To prevent your time zone from changing after you set it for Windows Server section on the Windows tab of Change the time zone of your instance.

If your instance is joined to a domain in AWS Directory Service for Microsoft Active Directory, then change the time settings. The time settings on your instance must use the domain controller as the time source to avoid a time skew. A time skew breaks authentication because of Kerberos restrictions. This missing authentication might cause issues when you log in to the instance. For more information, see "It's Simple!" – Time Configuration in Active Directory on the Microsoft website.

The Amazon Time Sync Service is behind other atomic clocks by X minutes

To resync the Amazon Time Sync Service to your instance, complete the following steps:

1. Open a command prompt window as Administrator.

2. To reset the NTP server to point to the Amazon Time Sync Service server, run the following command:

   w32tm /config /manualpeerlist:"169.254.169.123,0x9" /syncfromflags:manual /update

3. To stop the time service and then remove all configuration information from the registry on your installation of Windows Server, run the following command:

   net stop w32time
   w32tm /unregister

4. From the Start menu on the instance, select Run, and enter services.msc. Verify that Windows Time is deleted.

5. To complete the resync, run the following commands:

   w32tm /register
   Net start w32time
   w32tm /query /configuration /verbose
   w32tm /resync /rediscover && w32tm /resync /force
   w32tm /query /status /verbose
   w32tm /stripchart /computer:169.254.169.123 /period:5
   w32tm /query /source

Note: If you see the local CMOS clock, wait a few minutes. Then, run the w32tm /query /source command again to verify the source.

Related information

W32tm on the Microsoft website