locked
w32tm /query /status Access is denied. (0x80070005) from elevated prompt‎ RRS feed

  • Question

  • I am in the process of decomissioning the 2008 DC so I have moved all FSMO roles to another DC. The old DC is getting time from the newly promoted PDC as are the domain clients it seems.

    I have gone through this below more times than I should have needed, the info is clear and it seems to work. however I still get an error from an elevated cmd prompt.

    C:\Windows\System32>w32tm /query /status

    or

    C:\Windows\System32>w32tm /query /configuration

    The following error occurred: Access is denied. (0x80070005)

    pushd %SystemRoot%\system32
    .\net stop w32time
    .\w32tm /unregister
    .\w32tm /register
    .\sc config w32time type= own
    .\net start w32time
    .\w32tm /config /update /manualpeerlist:"0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org",0x8 /syncfromflags:MANUAL /reliable:yes
    .\w32tm /resync
    popd

    Why am I not able to run a query on the PDC with an elevated cmd prompt and I do have domain rights in all the right areas! I have never had this problem before.


    Thanks, Charlie


    • Edited by CJlindell Thursday, May 16, 2013 9:38 PM
    Thursday, May 16, 2013 9:37 PM

Answers

  • Did you try running a sfc /scannow?

    Also I would try exporting the win32tm reg key from a working computer and importing it. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time


    http://mariusene.wordpress.com/

    I can run w32tm /query /status on another DC and it is getting time from the PDC in question. By copying the key from the working DC to the one with the problem I would then need to manually edit the time servers and set other key as needed, about 5 of them if I recall then bounce the server. Heck for that matter I'd also replace the 3 w32* files in system32.

    What do you think?


    Thanks, Charlie

    • Proposed as answer by Jason Mei Wednesday, June 19, 2013 11:54 AM
    • Marked as answer by Vivian_Wang Thursday, June 20, 2013 4:07 AM
    • Unmarked as answer by CJlindell Thursday, June 20, 2013 3:45 PM
    • Marked as answer by Hamid Sadeghpour SalehMVP Thursday, January 30, 2020 10:40 AM
    Thursday, May 30, 2013 11:20 PM

All replies

  • If its not working with domain admin account then it can be issue with the virus/worm/malware. I have seen this issue in the past & it was due to infection in the system. The other angle is verifying windows in built firewall service might be the cause, try to disable it temporarily & see if it works. Verify the registry permission or use procmon to scan the permission on the registry.

    Awinish Vishwakarma - MVP

    My Blog: awinish.wordpress.com

    Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

    Friday, May 17, 2013 1:20 AM
  • Agree with Awinish, however I would suggest you to try manual changes through registry using below link.

    support.microsoft.com/kb/816042

    support.microsoft.com/kb/816042
    • Edited by VenkatSP Friday, May 17, 2013 3:55 AM
    Friday, May 17, 2013 3:54 AM
  • If its not working with domain admin account then it can be issue with the virus/worm/malware. I have seen this issue in the past & it was due to infection in the system. The other angle is verifying windows in built firewall service might be the cause, try to disable it temporarily & see if it works. Verify the registry permission or use procmon to scan the permission on the registry.

    Awinish Vishwakarma - MVP


    The DC has Trend Office scan enterprise on it and is not used for browsing, it is clean. Why would the firewall not allow me to veryify settings or status? The firewall is on and I opened inbound and outbound 123 udp. Again it is servicing time requests, I just can't check the config on it from a cmd prompt and the registry looks fine.

    Thanks, Charlie

    Friday, May 17, 2013 3:10 PM
  • Agree with Awinish, however I would suggest you to try manual changes through registry using below link.

    support.microsoft.com/kb/816042

    support.microsoft.com/kb/816042

    I will evaluate

    Thanks, Charlie

    Friday, May 17, 2013 3:11 PM
  • Hi,

    Just want to confirm the current situation.

    Have you check this KB article?

    How to configure an authoritative time server in Windows Server

    http://support.microsoft.com/kb/816042

    If you have any feedback on our support, please click here

    Regards.


    Vivian Wang
    TechNet Community Support

    Tuesday, May 21, 2013 5:51 AM
  • Hi,

    Just want to confirm the current situation.

    Have you check this KB article?

    How to configure an authoritative time server in Windows Server

    http://support.microsoft.com/kb/816042

    If you have any feedback on our support, please click here

    Regards.


    Vivian Wang
    TechNet Community Support


    I have read the how to's and have done it according to the how to guides and it seems to be working! I cannot run a local query on the PDC and I cannot determine why.

    Thanks, Charlie

    Tuesday, May 21, 2013 4:49 PM
  • You can simply uninstall time services & reconfigure the parameters. You can also enable time logging to see whats going on behind the scene.

    - Type CMD in the run windows

    -  Type Net stop w32time to stop the time service

    -  Type W32tm /unregister to unregister the time service registry

    -  Type W32tm /register to register the time service registry back

    -  Type Net start w32time

    Configuring a time source for the forest  http://technet.microsoft.com/en-us/library/cc784800%28WS.10%29.aspx

    How to turn on debug logging in the Windows Time Service  http://support.microsoft.com/kb/816043

    Windows Time Server Role in AD Forest/Domain


    Awinish Vishwakarma - MVP

    My Blog: awinish.wordpress.com

    Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

    Wednesday, May 22, 2013 1:33 AM
  • Do you have any related errors in the event logs? Have you tried this:

    Ensure that the Windows Time service can read its registry configuration settings

    To ensure that the Windows Time service can read its registry configuration settings:

    Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

    1. Open Registry Editor. To open Registry Editor, click Start. In Start Search, type regedit, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
    2. Go to the Config key in the registry by expanding the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time.
    3. Right-click the Config key, and then click Permissions. The Permissions for Config dialog box opens.
    4. On the Security tab, under Group or user names, ensure that the W32Time account is listed.
    5. Click the Advanced button. The Advanced Security Settings for Config dialog box opens.
    6. Select the W32Time account in the list of permission entries.
    7. Click Edit. The Permission Entry for Config dialog box opens.
    8. In the Permission Entry for Config dialog box, ensure that W32Time has the following permissions selected in the Allow column: Query Value, Set Value, Create Subkey, Enumerate Subkeys, Notify, Delete, and ReadControl. If any of those permissions are not set to Allow, select the box next to the appropriate permission in the Allow column. Ensure that there is nothing selected in the Deny column.
    9. If you made any changes, click OK. Otherwise, click Cancel. The Permission Entry for Config dialog box closes.
    10. Click OK in the Advanced Security Settings for Config dialog box.
    11. Click OK in the Permissions for Config dialog box.

    ...from http://technet.microsoft.com/en-us/library/cc733213(v=ws.10).aspx


    http://mariusene.wordpress.com/

    Wednesday, May 22, 2013 6:34 AM
  • You can simply uninstall time services & reconfigure the parameters. You can also enable time logging to see whats going on behind the scene.

    - Type CMD in the run windows

    -  Type Net stop w32time to stop the time service

    -  Type W32tm /unregister to unregister the time service registry

    -  Type W32tm /register to register the time service registry back

    -  Type Net start w32time

    Configuring a time source for the forest  http://technet.microsoft.com/en-us/library/cc784800%28WS.10%29.aspx

    How to turn on debug logging in the Windows Time Service  http://support.microsoft.com/kb/816043

    Windows Time Server Role in AD Forest/Domain


    Awinish Vishwakarma - MVP

    Yeah, I did all that several times and rebuilt using the cmds below as well as without like yours shows. Running the cmd's like yours I also had to run sc config w32time type= own. It seems like permissions, but I am not sure where I would need to look.

    pushd %SystemRoot%\system32
    .\net stop w32time
    .\w32tm /unregister
    .\w32tm /register
    .\sc config w32time type= own
    .\net start w32time
    .\w32tm /config/update /manualpeerlist:"0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org",0x8/syncfromflags:MANUAL /reliable:yes
    .\w32tm /resync
    popd


    Thanks, Charlie


    • Edited by CJlindell Wednesday, May 22, 2013 3:51 PM
    Wednesday, May 22, 2013 3:50 PM
  • Do you have any related errors in the event logs? Have you tried this:

    Ensure that the Windows Time service can read its registry configuration settings

    To ensure that the Windows Time service can read its registry configuration settings:

    Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

    1. Open Registry Editor. To open Registry Editor, click Start. In Start Search, type regedit, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
    2. Go to the Config key in the registry by expanding the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time.
    3. Right-click the Config key, and then click Permissions. The Permissions for Config dialog box opens.
    4. On the Security tab, under Group or user names, ensure that the W32Time account is listed.
    5. Click the Advanced button. The Advanced Security Settings for Config dialog box opens.
    6. Select the W32Time account in the list of permission entries.
    7. Click Edit. The Permission Entry for Config dialog box opens.
    8. In the Permission Entry for Config dialog box, ensure that W32Time has the following permissions selected in the Allow column: Query Value, Set Value, Create Subkey, Enumerate Subkeys, Notify, Delete, and ReadControl. If any of those permissions are not set to Allow, select the box next to the appropriate permission in the Allow column. Ensure that there is nothing selected in the Deny column.
    9. If you made any changes, click OK. Otherwise, click Cancel. The Permission Entry for Config dialog box closes.
    10. Click OK in the Advanced Security Settings for Config dialog box.
    11. Click OK in the Permissions for Config dialog box.

    I checked everything and it was identical! I tried rerunning the cmd w32tm /query /configuration and the same error, very frustrating.

    The following error occurred: Access is denied. (0x80070005)


    Thanks, Charlie

    Wednesday, May 22, 2013 7:11 PM
  • Hi,

    Please also check the similar thread:

    w32tm Access is denied. (0x80070005) from elevated prompt        

    http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/9bdfc2cc-4775-4435-8868-57d214e1e3ba

    If you have any feedback on our support, please click here

    Regards.


    Vivian Wang
    TechNet Community Support

    Thursday, May 23, 2013 7:14 AM
  • Hi,

    Please also check the similar thread:

    w32tm Access is denied. (0x80070005) from elevated prompt        

    http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/9bdfc2cc-4775-4435-8868-57d214e1e3ba

    Regards.


    Vivian Wang


    Vivian,

    I have seen that thread multiple times and thought how easy could that be! I reran the cmd's as Awinish asked 2 times, and no change. How many times should I try rerunning these cmd's and still have no change when I want to query the PDC to verify? I questioned rights and don't know if UAC was diasabled prior to running DCpromo on this server. I would think that once it is a DC UAC no longer works, but I have no way to verify and I am never prompted when making other changes so I would think it was turned off. I case it wasn't I ran the cmd below to ensure the key was in the registry and restarted. I reran the w32tm /query /configuration and still get the error.

    As I have mentioned time seems to be working, I just cannot run any local checks on the DC and I should be able to without any restrictions, I am the Domain Admin!

    If possible reboot the DC & run below cmd. If you get access denied for the first attempt to unregister rerun the same cmd. Can you make sure windows 2008 R2 is running with latest service pack & patches. If nothing works, running SFC /SCANNOW will be more viable option.

    Can you try with some other domain admin account,newly created not the existing one, trying to sort out if there is corruption with ID.

    net stop w32time
    w32tm /unregister
    w32tm /register
    net start w32time

    How to configure authoritative tine server

    http://support.microsoft.com/kb/816042

    Regards


    Awinish Vishwakarma


    Thanks, Charlie

    Thursday, May 23, 2013 4:24 PM
  • Hi,

    Have you seen any error related to W32TM in the event log? Also, please try to boot the sever into safe mode with network and then verify if this issue happens again.


    Best regards, Jason Mei Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Friday, May 24, 2013 9:17 AM
  • Hi,

    Have you seen any error related to W32TM in the event log? Also, please try to boot the sever into safe mode with network and then verify if this issue happens again.


    Best regards, Jason Mei Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Interestingly enough as I am removing an dead namespace server and checking dcdiag I found this entry!

    Starting test: Services
           Invalid service type: w32time on DCSERVER, current value WIN32_OWN_PROCESS, expected value
           WIN32_SHARE_PROCESS
        ......................... DCSERVER failed test Services

    How do I change the service to WIN32_SHARE_PROCESS


    Thanks, Charlie

    Wednesday, May 29, 2013 7:02 PM
  • I thought that by changing the w32time to a shared process it would work, no if failed to start.

    C:\Windows\System32>.\net stop w32time
    The Windows Time service is stopping.
    The Windows Time service was stopped successfully.


    C:\Windows\System32>.\sc config w32time type= share
    [SC] ChangeServiceConfig SUCCESS

    C:\Windows\System32>.\net start w32time
    System error 1290 has occurred.

    The service start failed since one or more services in the same process have an incompatible service SID type setting. A service with restricted service SID type can only coexist in the same process with other services with a restricted SID type. If the service SID type for this service was just configured, the hosting process must be restarted in order to start this service.


    Thanks, Charlie

    Wednesday, May 29, 2013 7:20 PM
  • I changed the service back to own and it started.

    C:\Windows\System32>.\sc config w32time type= own
    [SC] ChangeServiceConfig SUCCESS

    C:\Windows\System32>.\net start w32time
    The Windows Time service is starting.
    The Windows Time service was started successfully.


    Thanks, Charlie

    Wednesday, May 29, 2013 7:22 PM
  • HI,

    Please take a look at following links

    http://support.microsoft.com/kb/2512643 

    http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/aaee7dec-d1a9-4f8a-a1c1-ee24ff08f074


    Best regards, Jason Mei Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.


    • Edited by Jason Mei Thursday, May 30, 2013 8:10 AM typo
    Thursday, May 30, 2013 8:10 AM
  • HI,

    Please take a look at following links

    http://support.microsoft.com/kb/2512643 

    http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/aaee7dec-d1a9-4f8a-a1c1-ee24ff08f074


    Best regards, Jason Mei Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.


    Jason, first thanks for looking, however did you read my thread? These links really don't have anthing to do specificlly with my issue, similar but not the same. It really doesn't have anything to do with dcdiag. I found what seemed to be something related to my issue when I ran dcdiag while upgrading FRS to DFSR and I spotted a failure and I considered it to be related to being unable to run w32tm /query /status. and I am being denied.

    Thanks, Charlie



    • Edited by CJlindell Thursday, May 30, 2013 4:35 PM
    Thursday, May 30, 2013 4:34 PM
  • Did you try running a sfc /scannow?

    Also I would try exporting the win32tm reg key from a working computer and importing it. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time


    http://mariusene.wordpress.com/

    Thursday, May 30, 2013 5:45 PM
  • Did you try running a sfc /scannow?

    Also I would try exporting the win32tm reg key from a working computer and importing it. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time


    http://mariusene.wordpress.com/

    I can run w32tm /query /status on another DC and it is getting time from the PDC in question. By copying the key from the working DC to the one with the problem I would then need to manually edit the time servers and set other key as needed, about 5 of them if I recall then bounce the server. Heck for that matter I'd also replace the 3 w32* files in system32.

    What do you think?


    Thanks, Charlie

    • Proposed as answer by Jason Mei Wednesday, June 19, 2013 11:54 AM
    • Marked as answer by Vivian_Wang Thursday, June 20, 2013 4:07 AM
    • Unmarked as answer by CJlindell Thursday, June 20, 2013 3:45 PM
    • Marked as answer by Hamid Sadeghpour SalehMVP Thursday, January 30, 2020 10:40 AM
    Thursday, May 30, 2013 11:20 PM
  • Hi,

    We may need  more logs to troubleshoot this issue, so please create a case to MS support team. They will help you solve this issue.


    Best regards, Jason Mei Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Friday, May 31, 2013 11:12 AM
  •  please create a case to MS support team. They will help you solve this issue.



    Is this pay for support, or if not how do I open one?

    Thanks, Charlie

    Thursday, June 20, 2013 3:47 PM
  • HI,

    It requires your SA agreement, so it needs you pay if you don't have SA agreement. 


    Best regards, Jason Mei Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Friday, June 21, 2013 1:36 AM
  • HI,

    It requires your SA agreement, so it needs you pay if you don't have SA agreement. 


    Best regards, Jason Mei Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.


    We don't have Microsoft Software Assurance so I likely won't be fixing this anytime soon

    Thanks, Charlie

    Friday, June 21, 2013 1:52 AM
  • Anyone else having this problem and unable to resolve it?  I've tried all of the recommended solutions listed in this thread (as well as the other threads that are linked from this one) and cannot query w32time using w32tm.exe whatsoever.  I continually get the "Access is denied. (0x80070005)" error.  I can verify from the Event Viewer that the service is, in fact, running properly and querying AD for a domain controller to sync time with, but without the use of w32tm.exe, I have no way of querying the service to see what it is doing.  This is happening on two different physical WS08R2 boxes.  Thoughts?
    Monday, August 19, 2013 8:00 PM
  • Anyone else having this problem and unable to resolve it?  I've tried all of the recommended solutions listed in this thread (as well as the other threads that are linked from this one) and cannot query w32time using w32tm.exe whatsoever.  I continually get the "Access is denied. (0x80070005)" error.  I can verify from the Event Viewer that the service is, in fact, running properly and querying AD for a domain controller to sync time with, but without the use of w32tm.exe, I have no way of querying the service to see what it is doing.  This is happening on two different physical WS08R2 boxes.  Thoughts?

    I'd sure like to know what the fix is, this seems dead in that no one is paying any attention to it.

    Thanks, Charlie

    Monday, August 19, 2013 8:02 PM
  • FWIW, these are both non domain controllers that are members of the same domain.

    We recently made widespread time changes by removing a GPO that was manually pointing all domain members (including DCs) to a local NTP appliance (against MS best practices), and instead, allowing w32time to query AD find the appropriate time provider.  This has been a really painstaking task -- with a lot of these systems, w32time does not want to "forget" the original/manually configured NTP source.  It has required everything from w32tm /config /syncfromflags:domhier /update to w32tm /unregister then /register to flush out the old settings entirely, and allow the service to do what it's supposed to do.

    Everyone seems to suggest the sc config procedure, repeating the /unregister /register steps, rebooting, and checking the registry permissions, all unsuccessfully.  Some folks start suggesting commands to run within w32tm.exe, which I believe to be down the wrong path -- the logical configuration of our time is correct now (and the event 35 from the time system confirms this) -- this is simply the ability to use the diagnostic w32tm.exe tool.

    Monday, August 19, 2013 8:13 PM
  • I believe that running w32tm /unregister and then w32tm /register is what whacks it out and the rights are never correct again.

    Thanks, Charlie

    Monday, August 19, 2013 8:28 PM
  • In situations where w32time is being especially stubborn, I've had pretty good success with /unregister and then /register.  It seems that situations that necessitate the sc config step are those systems that are going to start showing the above behavior.  Honestly, I think that w32time is an after thought to MS -- by large it works the way it is supposed to, but when things start to get wonky, there's really no systematic way to troubleshooting the service itself (and I'm referring especially to the binaries for the w32time service itself - not necessarily the logical configuration that one should being using in their AD environment; thankfully, the best practices for that are very well explained and mostly understood by all).
    Monday, August 19, 2013 8:50 PM
  • It has now happened to a fourth machine and I think I've found some repeatable behavior to report:

    1. These are all WS08R2.
    2. On at least two of these boxes, after a reboot, the Windows Time service has disappeared altogether.  Just gone.
    3. I run w32tm /register which causes the service to be created.
    4. I try net start w32time and get this result: System error 1290 has occurred.  The service start failed since one or more services in the same process have an incompatible service SID type setting. A service with restricted service SID type can only coexist in the same process with other services with a restricted SID type. If the service SID type for this service was just configured, the hosting process must be restarted in order to start this service.
    5. I run sc config w32time type= own, which completes successfully: [SC] ChangeServiceConfig SUCCESS
    6. Then I net start w32time, and the service starts OK.  I get an Information event 37 followed by a 35 from Time-Service, indicating that w32time has found a time source in AD and is now sync'ing,
    7. But when I use w32tm to do something like w32tm /query /status, I get: The following error occurred: Access is denied. (0x80070005)

    I can't explain it.  The time service is actually working, but I can't do a whole lot to troubleshoot with it.  Interestingly, however, a command like /stripchart does work, but anything having to do with /query gives me the aforementioned access denied error.

    Tuesday, August 20, 2013 4:59 PM
  • I found similar and when I ran sc config w32time type= own the service really does not want to be set to own, it wants to be set to shared but it won't run that way either.

    Thanks, Charlie

    Tuesday, August 20, 2013 5:03 PM
  • I found similar and when I ran sc config w32time type= own the service really does not want to be set to own, it wants to be set to shared but it won't run that way either.

    Thanks, Charlie

    Yeah, I think you're on to something here.  Using sc query W32time on a box where W32time is running properly, I get:

    SERVICE_NAME: w32time
            TYPE               : 20  WIN32_SHARE_PROCESS
            STATE              : 4  RUNNING
                                    (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
            WIN32_EXIT_CODE    : 0  (0x0)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0

    but on a box where I've had to jump through these hoops, I get:

    SERVICE_NAME: w32time
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 4  RUNNING
                                    (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
            WIN32_EXIT_CODE    : 0  (0x0)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0

    If I set the service type to shared on one of these problematic boxes, I start getting the SID error again.

    Tuesday, August 20, 2013 5:23 PM
  • This is where I found my deadend, it doesn't run properly when set to OWN as I believe you can't run a query against it but when SHARED it didn't run at all if memory serves me.

    Thanks, Charlie


    • Edited by CJlindell Tuesday, August 20, 2013 6:03 PM
    • Proposed as answer by alibek555 Friday, December 4, 2015 9:19 AM
    Tuesday, August 20, 2013 6:03 PM
  • Charlie -- give this a go when you have chance (all as administrator, of course):

    1. stop w32time
    2. w32tm /unregister
    3. reboot
    4. regsvr32 /u w32time.dll
    5. w32tm /register
    6. sc query w32time -- you should see that the service is set to shared mode -- this is presumably how it should be -- if you try to start right now, you'll get the expected 1290 SID-related error
    7. reboot
    8. w32time should now automatically start at boot up and be running -- that was my result -- it's running as shared, started on its own, and I can do the w32tm /query commands successfully
    • Proposed as answer by Keith N. _ Wednesday, November 18, 2015 5:30 AM
    Tuesday, August 20, 2013 6:39 PM
  • Charlie -- give this a go when you have chance (all as administrator, of course):

    1. stop w32time
    2. w32tm /unregister
    3. reboot
    4. regsvr32 /u w32time.dll
    5. w32tm /register
    6. sc query w32time -- you should see that the service is set to shared mode -- this is presumably how it should be -- if you try to start right now, you'll get the expected 1290 SID-related error
    7. reboot
    8. w32time should now automatically start at boot up and be running -- that was my result -- it's running as shared, started on its own, and I can do the w32tm /query commands successfully

    I swear I've rebooted after running it as shared but then again it's been a while. I can't do this for a few days but will within a day or two. If this is the case you get the fix and perhaps it will help someone else someday as MS surely has not suggested how to address this.

    Thanks, Charlie

    Tuesday, August 20, 2013 7:08 PM
  • Please do.  I just tried it on the second machine that was having issues and it fixed the problem.  One notable thing is that if you try running step #4 before #3, you'll get an error about unregistering the DLL....so I'm thinking that the w32tm /unregister step is not able to fully complete w/o a reboot first.

    Tuesday, August 20, 2013 7:38 PM
  • Charlie -- give this a go when you have chance (all as administrator, of course):

    1. stop w32time
    2. w32tm /unregister
    3. reboot
    4. regsvr32 /u w32time.dll
    5. w32tm /register
    6. sc query w32time -- you should see that the service is set to shared mode -- this is presumably how it should be -- if you try to start right now, you'll get the expected 1290 SID-related error
    7. reboot
    8. w32time should now automatically start at boot up and be running -- that was my result -- it's running as shared, started on its own, and I can do the w32tm /query commands successfully

    Thanks for this Ben, fixed the problem for me.

    dave

    • Proposed as answer by Nidhin CK Tuesday, January 3, 2017 2:40 AM
    Friday, September 6, 2013 10:05 AM
  • Hey,

    this works for me... thanks

    Vaibahv

    Tuesday, October 22, 2013 12:51 PM
  • Many Thanks Ben,

    Special thanks to CJ for posting this problem that has plagued me for over a year.

    Ben, your solution is the missing piece to this puzzle.

    Many thanks to both of you.

    Raul

    Monday, February 24, 2014 8:24 PM
  • Similar issues here.
    I had a damaged registry key somewhere under w32tm, so manually deleting the whole key allowed me to re-register with w32tm /register and rebuild the key

    second issue was my GPO - i'd set up the domain to come to the PDC for time, but forgot to make sure the PDC didn't come to itself. In the end, i needed to make a new group with every machine but the PDC in it and apply the GPO to that group only, via security filtering. GPO scope could really do with an 'exclude' option...
    Thursday, April 23, 2015 1:49 AM
  • This fixed it for me.  I hope this gets marked as the answer so more people will know there is a fix at the end of this really long thread.
    Wednesday, November 18, 2015 5:31 AM
  • Thank you :)
    Wednesday, December 14, 2016 8:45 AM
  • I know this is an old post but I ran into this issue recently and was just able to fix it. I had the exact issue the OP, Charlie had. I only got the error when executing "w32tm /query /status"

    Some things I tried were unregistering/registering the service, created a new local domain account, rebooted several times, ran sfc /scannow but none of them worked.

    So here is what I did that ultimately fixed my issue:

    1. sc config w32time type= share (changed it back to the shared type here)
    2. net stop w32time
    3. got the shared process error here
    4. rebooted the server, verified w32time started.
    5. ran sc config /query /status and was successful


    Wednesday, May 24, 2017 3:43 PM
  • Another such problem... I tried above solutions but after 1 month it reappeared :(

    I checked permissions on "Config" key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time

    There was NO user w32time - and the system literally has no such "user". Checked that other server which runs flawlessly has it.
    I guess this is a "user" created when registering service?!
    Unable to create such user and looking for fast solution I gave permissions to "Everyone" on Config key.

    net start w32time - Started :S, now working at least from cmd prompt... Hopefully service will autosatrt after restart because time service is vital for that machine

    And yes, the server is running 2008R2...
    Any idea how to recreate the W32Time "user" ?

    Monday, June 4, 2018 6:52 AM
  • I have the same problem... I tried above solutions and it works! Many thanks to Ben and other guys!
    Thursday, December 27, 2018 9:59 AM
  • ABSOLUTE TRUE ANSWER, worked like a charm.

    only thing different is point 1. net stop w32rime

    fantastic write up thank you so much

    Friday, June 28, 2019 6:43 AM
  • Thank you!
    Thursday, July 18, 2019 3:57 AM
  • Come on Microsoft, FIX this!!

    This thread exists since 2013.

    It is 2020, I am on Windows 10, and this is STILL buggering me, without having found any solution so far.

    I have previously searched and tried many 'solutions'.

    I have just tried again.

    How come that a ESSENTIAL functionality, that is supposed to work automatically, just won't start, without any known cause?!!

    And yes, it is STILL 'access denied'.


    • Edited by Robertie Sunday, March 1, 2020 7:10 PM
    Sunday, March 1, 2020 6:48 PM