Windows 10 unable to time sync, time service is greyed out

1

I am using a Windows 10 machine which is unable to sync time automatically.

Clicking on "Sync now" on the Date & Time Settings produces an error "Time synchronization failed". The problem has been going on for a long time, as the last successful sync is shown to have happened 1 year ago.

The Time Service logs in Event Viewer are empty. Aside from that, Event Viewer contains no message connected to time synchronization.

In Services, the Windows Time service is set to "Manual (Trigger Start)" and its status is blank. When clicking on the service, everything is greyed out, so it cannot be started manually. (See screenshot below.)

enter image description here

Launching a command prompt as admin and trying to operate on the service via CLI produce the following errors:

C:\WINDOWS\system32>net stop w32time
The Windows Time service is not started.

More help is available by typing NET HELPMSG 3521.


C:\WINDOWS\system32>net start w32time
System error 5 has occurred.

Access is denied.


C:\WINDOWS\system32>w32tm /unregister
The following error occurred: Access is denied. (0x80070005)

C:\WINDOWS\system32>w32tm /register
The following error occurred: Access is denied. (0x80070005)

The Task Scheduler reports the same error 0x5 for task SynchronizeTime. Details of tasks SynchronizeTime and ForceSynchronizeTime are all greyed out.

I have run DISM and SFC as suggested here, and it did not find any integrity violation:

C:\WINDOWS\system32>DISM.exe /Online /Cleanup-image /Restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.18362.1

Image Version: 10.0.18362.657

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.


EDIT 1:

Here's the output of sc sdshow w32time, converted via ConvertFrom-SddlString -Sddl "<output>":

Owner            :
Group            :
DiscretionaryAcl : {NT AUTHORITY\INTERACTIVE: AccessAllowed (CreateDirectories, GenericExecute, ListDirectory, Read,
                   ReadAttributes, ReadExtendedAttributes, ReadPermissions, WriteAttributes), NT AUTHORITY\SYSTEM:
                   AccessAllowed (ChangePermissions, CreateDirectories, Delete, DeleteSubdirectoriesAndFiles,
                   ExecuteKey, FullControl, GenericAll, GenericExecute, GenericRead, GenericWrite, ListDirectory,
                   Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes, ReadPermissions,
                   TakeOwnership, Traverse, Write, WriteAttributes, WriteData, WriteExtendedAttributes, WriteKey),
                   BUILTIN\Administrators: AccessAllowed (CreateDirectories, GenericExecute, ListDirectory, Read,
                   ReadAttributes, ReadExtendedAttributes, ReadPermissions, WriteAttributes)}
SystemAcl        : {Everyone: SystemAudit FailedAccess (ChangePermissions, CreateDirectories, Delete,
                   DeleteSubdirectoriesAndFiles, ExecuteKey, FullControl, GenericAll, GenericExecute, GenericRead,
                   GenericWrite, ListDirectory, Modify, Read, ReadAndExecute, ReadAttributes, ReadExtendedAttributes,
                   ReadPermissions, TakeOwnership, Traverse, Write, WriteAttributes, WriteData,
                   WriteExtendedAttributes, WriteKey)}
RawDescriptor    : System.Security.AccessControl.CommonSecurityDescriptor


EDIT 2:

I've tried to apply different permissions to the service (see @Robert's comment):

sc sdset w32time "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPLOCRRC;;;LS)(A;;CCSWWPLORC;;;LS)"

but it fails with this error:

[SC] OpenService FAILED 5:

Access is denied.

All the commands above were launched on a Command Prompt run as Administrator.

windows-10
permissions
time
asked on Super User Mar 6, 2020 by dr_ • edited Mar 14, 2020 by dr_

2 Answers

2

@Robert in comments pointed out HOW to check permissions of service which appear to be incorrect on your PC & he's given you steps on how to fix which you have declined. I am thinking its unlikely you will find the answer to WHY that service got messed up TBH. However you may want to update/rephrase your question to indicate what you are trying to solve exactly: the problem itself or the reason why the problem occurred. Below is some info I can provide that may be helpful:

  • Win10 v1607 Enterprise x64 here in domain & my W32Time service is manual, entirely greyed out, & no dependencies so I speculate that is normal
  • WinMerge screenshot comparing your W32Time service security ACL vs mine: enter image description here
answered on Super User Mar 11, 2020 by gregg • edited Mar 12, 2020 by gregg
2

If your computer participates in a domain, it is normal that the properties of the Windows Time system service are not modifiable. They would be grayed out by default and the time is synchronized with the domain controller, as required for Kerberos authentication. You should in this case address yourself to the administrator of the domain.

If your computer is not on a domain, check first if this also happens when booting in Safe mode. If the Properties are still not modifiable, then there is a problem with Windows. Otherwise, some installed product is causing the problem.

If this also happens in Safe mode, check in the Local Group Policy Editor (gpedit.msc) if the permissions have not been corrupted.

Position to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment. Check here the item Change the system time whose property should be LOCAL SERVICE,Administrators,NT SERVICE\autotimesvc. Check also Change the time zone whose value should be LOCAL SERVICE,Administrators,Users,Device Owners.

If this is not the problem, to set all Windows components to a known state would require to Do a Repair Install of Windows 10 with an In-place Upgrade. This is exactly the same as doing a major Windows upgrade, so you should take similar precautions, but in most cases has no bad effects.

answered on Super User Mar 14, 2020 by harrymc • edited Mar 14, 2020 by harrymc

User contributions licensed under CC BY-SA 3.0