Windows 10 unable to time sync, time service is greyed out

I am using a Windows 10 machine which is unable to sync time automatically.

Clicking on "Sync now" on the Date & Time Settings produces an error "Time synchronization failed". The problem has been going on for a long time, as the last successful sync is shown to have happened 1 year ago.

The Time Service logs in Event Viewer are empty. Aside from that, Event Viewer contains no message connected to time synchronization.

In Services, the Windows Time service is set to "Manual (Trigger Start)" and its status is blank. When clicking on the service, everything is greyed out, so it cannot be started manually. (See screenshot below.)

Launching a command prompt as admin and trying to operate on the service via CLI produce the following errors:

C:\WINDOWS\system32>net stop w32time
The Windows Time service is not started.

More help is available by typing NET HELPMSG 3521.


C:\WINDOWS\system32>net start w32time
System error 5 has occurred.

Access is denied.


C:\WINDOWS\system32>w32tm /unregister
The following error occurred: Access is denied. (0x80070005)

C:\WINDOWS\system32>w32tm /register
The following error occurred: Access is denied. (0x80070005)

The Task Scheduler reports the same error 0x5 for task SynchronizeTime. Details of tasks SynchronizeTime and ForceSynchronizeTime are all greyed out.

I have run DISM and SFC as suggested here, and it did not find any integrity violation:

C:\WINDOWS\system32>DISM.exe /Online /Cleanup-image /Restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Image Version: 10.0.18362.657

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

EDIT 1:

Here's the output of sc sdshow w32time, converted via ConvertFrom-SddlString -Sddl "<output>":

Owner            :
Group            :
DiscretionaryAcl : {NT AUTHORITY\INTERACTIVE: AccessAllowed (CreateDirectories, GenericExecute, ListDirectory, Read,
                   ReadAttributes, ReadExtendedAttributes, ReadPermissions, WriteAttributes), NT AUTHORITY\SYSTEM:
                   AccessAllowed (ChangePermissions, CreateDirectories, Delete, DeleteSubdirectoriesAndFiles,
                   ExecuteKey, FullControl, GenericAll, GenericExecute, GenericRead, GenericWrite, ListDirectory,
                   Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions,
                   TakeOwnership, Traverse, Write, WriteAttributes, WriteData, WriteExtendedAttributes, WriteKey),
                   BUILTIN\Administrators: AccessAllowed (CreateDirectories, GenericExecute, ListDirectory, Read,
                   ReadAttributes, ReadExtendedAttributes, ReadPermissions, WriteAttributes)}
SystemAcl        : {Everyone: SystemAudit FailedAccess (ChangePermissions, CreateDirectories, Delete,
                   DeleteSubdirectoriesAndFiles, ExecuteKey, FullControl, GenericAll, GenericExecute, GenericRead,
                   GenericWrite, ListDirectory, Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes,
                   ReadPermissions, TakeOwnership, Traverse, Write, WriteAttributes, WriteData,
                   WriteExtendedAttributes, WriteKey)}
RawDescriptor    : System.Security.AccessControl.CommonSecurityDescriptor

EDIT 2:

I've tried to apply different permissions to the service (see @Robert's comment):

sc sdset w32time "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPLOCRRC;;;LS)(A;;CCSWWPLORC;;;LS)"

but it fails with this error:

[SC] OpenService FAILED 5:

Access is denied.

All the commands above were launched on a Command Prompt run as Administrator.

EDIT 3, 24/2/2021: One year after my post, the problem went mysteriously away by itself (somehow). Now the clock appears synchronized (last time sync marked coincides with the last boot). Manually trying to time sync by clicking on "Sync now" on the Date & Time Settings still produces an error "Time synchronization failed", but at least it automatically syncs, and that's good enough for me.

If your computer participates in a domain, it is normal that the properties of the Windows Time system service are not modifiable. They would be grayed out by default and the time is synchronized with the domain controller, as required for Kerberos authentication. You should in this case address yourself to the administrator of the domain.

If your computer is not on a domain, check first if this also happens when booting in Safe mode. If the Properties are still not modifiable, then there is a problem with Windows. Otherwise, some installed product is causing the problem.

If this also happens in Safe mode, check in the Local Group Policy Editor (gpedit.msc) if the permissions have not been corrupted.

Position to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment. Check here the item Change the system time whose property should be LOCAL SERVICE,Administrators,NT SERVICE\autotimesvc. Check also Change the time zone whose value should be LOCAL SERVICE,Administrators,Users,Device Owners.

If this is not the problem, to set all Windows components to a known state would require to Do a Repair Install of Windows 10 with an In-place Upgrade. This is exactly the same as doing a major Windows upgrade, so you should take similar precautions, but in most cases has no bad effects.