Overview

The Windows Time Service Policy configures device time zone settings and Windows Time Service (W32Time) / NTP settings via the MDM Policy CSP. It uses two CSP families:

TimeLanguageSettings — sets the device time zone
ADMX_W32Time — configures the Windows Time Service (NTP client/server, clock discipline, etc.)

ADMX-backed settings use SyncML chr format with XML-encoded payloads.

Reference: Microsoft Policy CSP — ADMX_W32Time

Supported Platform: Windows

Owners: Company-managed devices, BYOD

Minimum System Requirements

Requirements differ depending on which settings you configure:

Setting Group	Minimum OS Version
Time Zone (`configureTimeZone`)	Windows 10 version 1903 (10.0.18362) and later
W32Time / NTP settings	Windows 10 2004/20H2/21H1 with KB5005101, or Windows 11 21H2 and later

Policy Fields

1. Configure Time Zone

Property	Value
Field name	`configureTimeZone`
Type	String
Description	Standard Windows time zone name applied to the device. Use names from `Get-TimeZone -ListAvailable` (e.g., `Pacific Standard Time`, `GMT Standard Time`).

Tip: Run Get-TimeZone -ListAvailable in PowerShell on any Windows device to see all valid time zone IDs.

2. Global Configuration Settings (`w32TimePolicyConfig`)

Configures clock discipline, general service behavior, and RODC chaining parameters.

Registry path: Software\Policies\Microsoft\W32Time\Config

Clock Discipline

Field	Display Name	Description	Type	Range	Default
`frequencyCorrectRate`	FrequencyCorrectRate	Rate at which W32time corrects local clock frequency. Lower = larger corrections.	Integer	0–4294967295	`4`
`holdPeriod`	HoldPeriod	Consistent time samples required before evaluating spikes.	Integer	0–4294967295	`5`
`largePhaseOffset`	LargePhaseOffset	Sample vs. local clock difference (100-ns units) treated as a spike.	Integer	0–4294967295	`50000000`
`maxAllowedPhaseOffset`	MaxAllowedPhaseOffset	Larger variation sets clock immediately; smaller is corrected gradually.	Integer	0–4294967295	`300`
`maxNegPhaseCorrection`	MaxNegPhaseCorrection	Past time sample difference above this value is discarded.	Integer	0–4294967295	`172800`
`maxPosPhaseCorrection`	MaxPosPhaseCorrection	Future time sample difference above this value is discarded.	Integer	0–4294967295	`172800`
`phaseCorrectRate`	PhaseCorrectRate	How quickly clock difference is corrected. Lower = faster.	Integer	0–4294967295	`7`
`pollAdjustFactor`	PollAdjustFactor	How quickly polling intervals change.	Integer	0–4294967295	`5`
`spikeWatchPeriod`	SpikeWatchPeriod	Time (seconds) before large-offset samples are accepted.	Integer	0–4294967295	`900`
`updateInterval`	UpdateInterval	Wait between gradual corrections (1/100 second units).	Integer	0–4294967295	`100`

General

Field	Display Name	Description	Type	Range	Default
`announceFlags`	AnnounceFlags	Bitmask for NetLogon time service advertisement.	Integer	0–4294967295	`10` (0x0a)
`eventLogFlags`	EventLogFlags	Special events logged to the System log.	Integer	0–4294967295	`2` (0x02)
`localClockDispersion`	LocalClockDispersion	Max error (seconds) reported to NTP clients using local CMOS clock.	Integer	0–4294967295	`10`
`maxPollInterval`	MaxPollInterval	Maximum polling interval, log₂ seconds (default = 2¹⁰ = 1024s).	Integer	0–15	`10`
`minPollInterval`	MinPollInterval	Minimum polling interval, log₂ seconds (default = 2⁶ = 64s).	Integer	0–15	`6`
`clockHoldoverPeriod`	ClockHoldoverPeriod	Max seconds the clock holds accuracy without sync before rediscovery.	Integer	0–4294967295	`7800`
`requireSecureTimeSyncRequests`	RequireSecureTimeSyncRequests	If `1`, DC won't respond to older authentication protocols.	Integer	0 or 1	`0`
`utilizeSslTimeData`	UtilizeSslTimeData	Use SSL traffic time data for clock correction.	Integer	0 or 1	`1`
`clockAdjustmentAuditLimit`	ClockAdjustmentAuditLimit	Smallest clock adjustments logged (PPM).	Integer	0–4294967295	`800`

RODC Chaining

Field	Display Name	Description	Type	Range	Default
`chainEntryTimeout`	ChainEntryTimeout	Max seconds a RODC chain entry remains before expiry.	Integer	0–4294967295	`16`
`chainMaxEntries`	ChainMaxEntries	Max RODC chaining table entries.	Integer	0–4294967295	`128`
`chainMaxHostEntries`	ChainMaxHostEntries	Max chaining entries per host.	Integer	0–4294967295	`4`
`chainDisable`	ChainDisable	If `1`, RODC chaining is disabled.	Integer	0 or 1	`0`
`chainLoggingRate`	ChainLoggingRate	Minutes between RODC chaining success/failure event logs.	Integer	0–4294967295	`30`

3. Configure Windows NTP Client (`w32TimePolicyConfigureNtpClient`)

Configures how the device discovers and communicates with NTP time sources.

Registry path: Software\Policies\Microsoft\W32time\TimeProviders\NtpClient

Field	Display Name	Description	Type	Values / Range	Default
`ntpServer`	NtpServer	DNS name or IP of NTP source in `dnsName,flags` format. Flags is a hex bitmask per host.	String	`dnsName,0xflags`	`time.windows.com,0x09`
`type`	Type	Controls the authentication/sync mode W32time uses.	String	`AllSync`, `NoSync`, `NT5DS`, `NTP`	`NT5DS`
`crossSiteSyncFlags`	CrossSiteSyncFlags	How W32time chooses sync partners outside its site (ignored unless Type is `NT5DS`).	Integer	0 = None, 1 = PdcOnly, 2 = All	`2`
`resolvePeerBackoffMinutes`	ResolvePeerBackoffMinutes	Minutes to wait before retrying DNS resolution after failure.	Integer	0–999999	`15`
`resolvePeerBackoffMaxTimes`	ResolvePeerBackoffMaxTimes	DNS resolve attempts before discovery restarts; wait doubles each failure.	Integer	0–999999	`7`
`specialPollInterval`	SpecialPollInterval	Poll interval (seconds) for manual/special-interval sources. Must fall within [2^MinPollInterval, 2^MaxPollInterval].	Integer	0–4294967295	`1024`
`eventLogFlags`	EventLogFlags	Bitmask: `0x1` = time jump events, `0x2` = source change, `0x3` = both.	Integer	0, 1, 2, or 3	`0`

Sync Type Reference

Value	Behavior
`NT5DS`	Sync from the domain hierarchy (default for domain-joined devices)
`NTP`	Sync from the server configured in `ntpServer`
`AllSync`	Use both domain hierarchy and NTP
`NoSync`	Disable time synchronization

4. Enable NTP Client (`enableNtpClient`)

Property	Value
Field name	`enableNtpClient`
Type	Boolean
Description	Enables or disables the Windows NTP Client time provider.

5. Enable NTP Server (`enableNtpServer`)

Property	Value
Field name	`enableNtpServer`
Type	Boolean
Description	Enables or disables the Windows NTP Server time provider.

⚠️ Warning: Enabling the NTP server on endpoints exposes a listening service. Only enable this on devices that need to serve time to other clients.

Common Deployment Patterns

Fixed-location kiosks or conference-room devices

Set configureTimeZone to the site's time zone and leave W32Time at defaults.

Domain-joined enterprise devices

Use type = NT5DS (the default) so devices sync from the domain hierarchy. Configure crossSiteSyncFlags = 2 to allow cross-site fallback.

Non-domain-joined or external NTP source

Set type = NTP, specify your NTP servers in ntpServer (e.g., pool.ntp.org,0x01), and set specialPollInterval to your desired polling frequency.

Troubleshooting

Symptom	Check
Time zone not applying	Verify the device meets Windows 10 1903+. Confirm the value matches a valid `Get-TimeZone -ListAvailable` ID exactly.
NTP settings not applying	Ensure the device has KB5005101 (Win 10) or is on Windows 11 21H2+.
Clock drifting despite policy	Check `maxNegPhaseCorrection` / `maxPosPhaseCorrection` — if too low, valid corrections are discarded.
Event log is noisy	Lower `eventLogFlags` or increase `clockAdjustmentAuditLimit` to suppress small-adjustment logs.
DNS resolution failures for NTP	Review `resolvePeerBackoffMinutes` and `resolvePeerBackoffMaxTimes` — defaults allow up to ~32 hours of exponential backoff before restart.

FAQ

Q: Can I set the time zone and W32Time settings in the same policy?
Yes. Both are part of the same policy object. Be aware they have different minimum OS requirements.

Q: What does the 0x09 flag mean in the default NTP server value?
It is a combination of 0x01 (SpecialInterval — use specialPollInterval) and 0x08 (Client — use client-mode association). See the Microsoft documentation for the full flag reference.

Q: What happens if minPollInterval is greater than maxPollInterval?
The W32Time service behavior is undefined. Always ensure minPollInterval ≤ maxPollInterval (both are log₂ values, max 15).

Windows Shared PC Mode Policy

Windows Power Policy

How to Verify and Fix Mac Date, Time, and Time Zone for Swif Agent

Apple Date Time Policy

Windows Firewall Policy