How do I troubleshoot time issues with my Amazon EC2 Windows instance?

Resolution

To synchronize your Amazon CloudWatch logs, metrics, local logs, and other services, it's a best practice to use UTC for your EC2 Windows instances.

Identify the current time source

Open Windows Command Prompt as an administrator, and then run the following commands:

w32tm /query /source
w32tm /query /status
w32tm /query /configuration

Review the output to determine which of the following time sources the instance uses:

• Local complementary metal-oxide-semiconductor (CMOS) Clock: The instance isn't actively synchronized with a time source.
• 169.254.169.123: The instance uses the local Amazon Time Sync Service.
  Note: It's a best practice to use the local Amazon Time Sync Service for standalone instances.
• Net Time 5 Directory Service (NT5DS): The instance is joined to a domain and follows the Microsoft Active Directory (AD) time hierarchy.
• Network Time Protocol (NTP) server: The instance uses a manually configured server.

If Local CMOS Clock is the source, then run the following command to check that the Windows Time service (W32Time) is in the RUNNING state:

sc query w32time

If the W32Time service isn't in the RUNNING state, then run the following command to configure the local Amazon Time Sync Service as the time source:

w32tm /config /manualpeerlist:"169.254.169.123,0x8" /syncfromflags:manual /update

To start the service, run the following command

net start w32time

To confirm the synchronization status, run the following command:

w32tm /query /status

Troubleshoot a time that continually resets

Time synchronization works differently on standalone or domain-joined instances. If you use standalone EC2 Windows instances, then use the local Amazon Time Sync Service at 169.254.169.123. Domain-joined instances automatically follow the Microsoft AD time hierarchy.

In a domain-joined environment, the Primary Domain Controller (PDC) emulator in the forest root domain is the authoritative time source. If you manually configure NTP settings on a domain-joined instance, then your group policy might override your manual configuration settings. After you reboot the instance or update the group policy, the time might change back.

If the time continues to reset, then check that the domain controller is healthy and synchronizes with a reliable external time source. On the domain controller, run the following commands:

w32tm /query /status
w32tm /query /source

To review the configured NTP settings, run the following command:

w32tm /query /configuration

Change your local group policy

Amazon provides the local Amazon Time Sync Service on all your EC2 instances. If you can't change the time settings in Windows System Settings or the Control Panel, then change your local group policy. Then, use Command Prompt to configure the local Amazon Time Sync Service on your instance.

To turn off the Prohibit access to Control Panel and PC settings policy, complete the following steps:

1. In the Windows Search field, enter Edit group policy, and then open it.
2. Choose User Configuration, and then choose Administrative Templates.
3. Choose Control Panel, and then choose Prohibit access to Control Panel and PC settings.
4. Choose Edit policy setting, and then select Disabled.

After you turn off the policy setting, change the time zone from the command prompt window. For instructions, choose the Windows tab on Change the time zone of your instance.

To update the time and date settings, complete the following steps:

1. Open Command Prompt as an administrator.
2. Enter time or date.
3. Enter one of the following values:
   For time, use the HH:MM:SS AM/PM format, for example 08:35:00 AM.
   For date, use the mm-dd-yyyy format, for example 01-01-2021.

The new time and date settings immediately take effect.

Note: XenServer VM Tools (formerly Citrix VM Tools or XenServer PV Tools) for Windows might cause issues with time synchronization. It's a best practice to update Windows PV drivers to Amazon PV drivers.

Keep the time that you set after the system reboots

To keep the new time that you set after you reboot Windows Server 2008 or later, add a RealTimeIsUniversal registry key. For instructions, see the To set the RealTimeIsUniversal registry key section in the Windows tab on Change the time zone of your instance.

If you joined your instance to a domain in AWS Directory Service for Microsoft Active Directory, then change the time settings. The time settings on your instance must use the domain controller as the time source to avoid a time skew.

By default, Kerberos authentication has a 5-minute tolerance. A time skew greater than 5 minutes can break authentication, and the missing authentication might cause issues when you log in to the instance. For more information, see "It's Simple!" – Time Configuration in Active Directory on the Microsoft website.

Review Event Viewer for time change events

To determine what triggered a time change, complete the following steps:

1. In the Windows Search field, enter Event Viewer and then open it.
2. Choose the Windows Logs dropdown list, and then choose System.
3. In the Actions section, choose Filter Current Log.
4. On the Event sources dropdown list, select Time-Service, and then choose OK.
5. Look for events that show time corrections or time source changes.

If event Security Event ID 4616 appears, then the system time changed. Review the event details to determine whether the change was manual or service driven.

Troubleshoot large forward or backward time jumps

Large time jumps might occur for the following reasons:

• Amazon EC2 restored the instance from a snapshot.
• The W32Time service corrected a significant time offset.
• The instance switched time sources.
• A domain controller experienced time drift and propagated the incorrect time.
• The configured NTP server lost network connectivity.

If a domain controller experiences drift, then all domain-joined instances can inherit the incorrect time.

Important: Before you troubleshoot member servers, validate synchronization on the domain controller.

To confirm that the domain controller correctly synchronizes, run the following command:

w32tm /query /status

In the output, check that the Source field shows a valid NTP server.

To test communication with the configured time source, run the following command:

w32tm /stripchart /computer:ntp-server /samples:5 /dataonly

Note: Replace ntp-server with the IP address of your NTP server. For standalone instances that use the local Amazon Time Sync Service, replace ntp-server with 169.254.169.123.

Resync the local Amazon Time Sync Service

If your instance's clock drifted, then use the local Amazon Time Sync Service to resync it.

Complete the following steps:

1. Open Command Prompt as an administrator, and then run the following commands:

   net stop w32time
   w32tm /unregister
   w32tm /register
   net start w32time
   w32tm /config /manualpeerlist:"169.254.169.123,0x8" /syncfromflags:manual /update
   w32tm /resync /rediscover
   w32tm /resync /force

2. To verify that the clock resynced, run the following commands:

   w32tm /query /configuration /verbose
   w32tm /query /status /verbose
   w32tm /stripchart /computer:169.254.169.123 /period:5
   w32tm /query /source
   

   Note: If Local CMOS Clock is the source, then wait a few minutes. Then, run w32tm /query /source again to verify that the source updated to 169.254.169.123.

Related information

Windows Time service tools and settings on the Microsoft website