WIN-026 · Script

Time Sync Repair

Checks the Windows Time service and clock offset and, in Fix mode, repairs the service and resyncs against the domain or your NTP servers.

What it does

Report mode (default) checks:

• the Windows Time (W32Time) service is installed, not disabled, and running
• the current time source (w32tm /query /source); a local clock source is flagged
• the clock offset against the time source, or against the first -NtpServer

and logs what Fix would change. Nothing is changed.

Fix mode:

• registers the Windows Time service if it is missing, sets it to Automatic and starts it
• domain-joined devices: points the service at the domain hierarchy, unless -NtpServer is given
• other devices: uses -NtpServer, or time.windows.com when -NtpServer is empty
• restarts the service, runs w32tm /resync /rediscover and measures the offset again

Domain controllers are never changed; the script reports and exits 1, as their time configuration should be managed on purpose. Output of w32tm is language dependent; the offset is read from the numeric value only. Runs silently as SYSTEM from any RMM or Intune. No prompts, no user interaction.

Requirements

Windows PowerShell 5.1+, run as SYSTEM or local admin. UDP 123 to the time source.

How to run it

• Run as: SYSTEM or a local administrator
• Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
• Script type: PowerShell, 64-bit
• User interaction: none; the script never prompts
• Timeout: 10 minutes (30 for Windows Update installs)

Settings

Exit codes

• 0 = Time service healthy and offset within limit (or fixed)
• 1 = Problem found (Report), problem remains after Fix, or device is a domain controller
• 2 = Script error

Testing steps

1. Run it first with the mode set to Report on one test device. Nothing is changed in that mode.
2. Read the log and confirm the planned changes are what you expect.
3. Run your chosen settings on the same test target and confirm the result.
4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
5. Roll out to a small group next, then everyone.

Rollback steps

Domain-joined: w32tm /config /syncfromflags:domhier /update then restart the W32Time service. Workgroup: w32tm /config /manualpeerlist:"<previous servers>" /syncfromflags:manual /update then restart W32Time. The previous time source is in the log line 'Current time source: ...'.

Version and change log