snipz

cheat sheet

tzutil & w32tm

Read and set the system timezone with tzutil, then query, configure, and force-sync the Windows Time service with w32tm — including NTP peer configuration and Kerberos-clock-drift recovery.

#tzutil#w32tm#windows#cli#sysadmin#time#ntp#sync#kerberos#referenceupdated 05-26-2026

tzutil & w32tm — Timezone and Windows Time

What it is

tzutil and w32tm are the two built-in Windows commands every sysadmin reaches for when "the clock is wrong" — and they are not interchangeable. tzutil (Time Zone Utility, shipped since Windows 7) reads and writes the display timezone of the box: which IANA-equivalent Windows zone the OS uses to render local times. w32tm is the command-line front end to the Windows Time service (W32Time), the NTP-compatible daemon that actually keeps the hardware clock disciplined to a trustworthy reference. On a domain-joined machine w32tm is what keeps Kerberos working — if the wall clock drifts more than five minutes from the domain controller, every Kerberos ticket is rejected and authentication breaks. On a standalone box it just controls whether time.windows.com (or your chosen NTP pool) is consulted.

When to use which

tzutil answers "what time zone does this box display in?". w32tm answers "is the underlying clock correct, and where is it synchronizing from?".

SymptomUseWhy
Times display in the wrong zonetzutil /s "Pacific Standard Time"Zone-only — doesn't touch the clock
Clock is off by minutes/hoursw32tm /resyncPulls time from the configured NTP peer
Kerberos auth failing across the domainw32tm /query /status then /resync /rediscoverVerifies domain-hierarchy sync
Set NTP source on a standalone boxw32tm /config /manualpeerlist:... /updateConfigures the time daemon
Measure drift against a referencew32tm /stripchart /computer:pool.ntp.orgContinuous offset sample
List every zone name on Windowstzutil /lEnumerates the OS's zone registry
Verify timezone of the running OStzutil /gOne-line answer

Both tools require an elevated console for anything that writes (tzutil /s, w32tm /config, w32tm /resync); read commands work as a normal user.

tzutil — time zone utility

tzutil.exe lives in C:\Windows\System32\ and ships in Windows 7 and later. It manipulates the registry key HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation and signals all running processes that the zone has changed.

Syntax

tzutil has only four useful switches: get, set, list, and DST opt-out. Everything else is a query variant.

cmd
tzutil { /g | /l | /s "<Zone>"[_dstoff] | /? }

Output: (none — exits 0 on success)

Essential options

SwitchMeaning
/gPrint the current timezone ID
/lList every available timezone (display name + ID, blank line between)
/s "<id>"Set the timezone (quoted; case-insensitive but spelling-strict)
/s "<id>_dstoff"Set the zone with daylight-saving auto-adjust disabled
/?Show usage

Reading the current timezone

/g prints the canonical Windows zone ID — the same string /s expects.

cmd
tzutil /g

Output:

css
Pacific Standard Time

Listing every available zone

/l walks the OS's registered zones. Each block is two lines: human display name then ID, separated by a blank line. Pipe into findstr to find the right ID quickly.

cmd
tzutil /l

Output:

sql
(UTC-12:00) International Date Line West
Dateline Standard Time

(UTC-11:00) Coordinated Universal Time-11
UTC-11

(UTC-10:00) Aleutian Islands
Aleutian Standard Time

(UTC-10:00) Hawaii
Hawaiian Standard Time

...
(UTC+00:00) Dublin, Edinburgh, Lisbon, London
GMT Standard Time

(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna
W. Europe Standard Time

...
cmd
rem Find the zone ID for a city/region
tzutil /l | findstr /I "Tokyo"

Output:

less
(UTC+09:00) Osaka, Sapporo, Tokyo
Tokyo Standard Time
cmd
rem How many zones does Windows know about?
tzutil /l | find /C "Standard Time"

Output:

code
141

Setting the timezone

/s writes the zone and broadcasts a WM_TIMECHANGE so Explorer and running apps update immediately — no reboot needed. Quote any zone ID that contains spaces (almost all of them).

cmd
tzutil /s "Eastern Standard Time"
tzutil /g

Output:

css
Eastern Standard Time
cmd
rem Asia-Pacific
tzutil /s "Tokyo Standard Time"
tzutil /g

Output:

css
Tokyo Standard Time
cmd
rem European
tzutil /s "W. Europe Standard Time"
tzutil /g

Output:

css
W. Europe Standard Time

Disabling daylight saving (_dstoff)

Appending _dstoff to the zone ID sets the timezone but tells Windows to ignore the DST schedule — useful for servers that should stay on a fixed offset year-round to avoid log discontinuities.

cmd
tzutil /s "Eastern Standard Time_dstoff"
tzutil /g

Output:

css
Eastern Standard Time

The display name returned by /g doesn't show _dstoff; check the registry to verify:

cmd
reg query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v DynamicDaylightTimeDisabled

Output:

markdown
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation
    DynamicDaylightTimeDisabled    REG_DWORD    0x1

PowerShell equivalents

Modern PowerShell (5.1+) ships Get-TimeZone / Set-TimeZone cmdlets that return objects rather than text.

powershell
Get-TimeZone
Get-TimeZone -ListAvailable | Where-Object Id -like "*Tokyo*"
Set-TimeZone -Id "Eastern Standard Time"

Output:

yaml
Id                         : Eastern Standard Time
DisplayName                : (UTC-05:00) Eastern Time (US & Canada)
StandardName               : Eastern Standard Time
DaylightName               : Eastern Daylight Time
BaseUtcOffset              : -05:00:00
SupportsDaylightSavingTime : True

w32tm — Windows Time service

w32tm.exe is the management front end to the W32Time service, Windows' implementation of SNTP/NTP. The service runs as LocalService and is managed via standard sc commands; w32tm is what you use to query its state, force a sync, change peers, and measure drift.

Service state

W32Time is started automatically on domain-joined machines but is set to Manual / Trigger Start on Windows 10/11 desktops by default. Before any w32tm operation, confirm the service is running.

cmd
sc query W32Time

Output:

yaml
SERVICE_NAME: W32Time
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
cmd
rem If stopped — start it and set to auto
sc config W32Time start= auto
net start W32Time

Output:

css
[SC] ChangeServiceConfig SUCCESS
The Windows Time service is starting.
The Windows Time service was started successfully.

Syntax

w32tm has a verb/noun grammar. The four most-used verbs are /query, /resync, /config, and /stripchart. Most write commands require /update to commit changes and a service restart to apply them fully.

cmd
w32tm /<verb> [options...]

Output: (varies by verb)

Essential options

Verb / optionMeaning
/query /statusCurrent sync state and last sample
/query /configurationAll effective config (resolved from registry + GP)
/query /peersList configured NTP peers and their state
/query /sourceJust the current source name
/resyncTrigger an immediate sync
/resync /rediscoverRe-evaluate domain hierarchy first, then sync
/resync /nowaitDon't block waiting for completion
/config /manualpeerlist:"<peers>"Set NTP peer list
/config /syncfromflags:MANUAL|DOMHIER|NOChoose peer source
/config /reliable:YES|NOMark this PDC as authoritative
/config /updateReload config (required after /config writes)
/stripchart /computer:<host>Continuous offset chart vs a peer
/monitor /computers:<list>Sample several peers once
/tzShow timezone info (same as tzutil /g plus offsets)
/leapseconds /getstatusLeap-second handling on this OS
/unregister / /registerRe-register the service (recovery only)

Current sync status

/query /status is the first thing to run when diagnosing a clock problem. It tells you who the box is syncing with, the last sample's offset, and whether the system clock is currently disciplined.

cmd
w32tm /query /status

Output:

yaml
Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Precision: -23 (119.209ns per tick)
Root Delay: 0.0468750s
Root Dispersion: 0.0312500s
ReferenceId: 0xC0A80101 (source IP:  192.168.1.1)
Last Successful Sync Time: 5/24/2026 10:14:22 AM
Source: dc01.contoso.local
Poll Interval: 10 (1024s)
cmd
rem Verbose — adds the underlying NTP packet fields
w32tm /query /status /verbose

Output:

sql
Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
...
Phase Offset: -0.0012345s
ClockRate: 0.0156250s
State Machine: 2 (Sync)
Time Source Flags: 0 (None)
Server Role: 0 (None)
Last Sync Error: 0 (The command completed successfully.)
Time since Last Good Sync Time: 142.5117423s

Listing configured peers

/query /peers shows every server in the manualpeerlist and how each one was contacted at last poll.

cmd
w32tm /query /peers

Output:

yaml
#Peers: 1

Peer: dc01.contoso.local,0x9
State: Active
Time Remaining: 845.1234567s
Mode: 1 (Symmetric Active)
Stratum: 2
PeerPoll Interval: 10 (1024s)
HostPoll Interval: 10 (1024s)

Effective configuration

/query /configuration dumps every parameter the service is using — useful for diffing two machines, or confirming a /config /update actually took effect.

cmd
w32tm /query /configuration

Output:

yaml
[Configuration]

EventLogFlags: 2 (Local)
AnnounceFlags: 10 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 6 (Local)
MaxPollInterval: 10 (Local)
MaxNegPhaseCorrection: 54000 (Local)
MaxPosPhaseCorrection: 54000 (Local)
MaxAllowedPhaseOffset: 300 (Local)

FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 7 (Local)
UpdateInterval: 100 (Local)

[TimeProviders]

NtpClient (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
CrossSiteSyncFlags: 2 (Local)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Local)
ResolvePeerBackoffMaxTimes: 7 (Local)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 1 (Local)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 1024 (Local)
Type: NT5DS (Local)

Forcing a sync

/resync sends one immediate NTP request to the current source. If the source is unreachable or the local sample is "too far off" to discipline gradually, the command fails and the system event log records the reason.

cmd
w32tm /resync

Output:

bash
Sending resync command to local computer
The command completed successfully.
cmd
rem Rediscover: re-resolve the source first (domain hierarchy or DNS)
w32tm /resync /rediscover

Output:

bash
Sending resync command to local computer
The command completed successfully.
cmd
rem Fire-and-forget — don't block waiting for the sample
w32tm /resync /nowait

Output:

bash
Sending resync command to local computer
The command completed successfully.

Configuring an NTP source (standalone)

On a non-domain machine, set one or more NTP peers manually. Multiple peers go in a single quoted, space-separated list. The ,0x1 (special poll) and ,0x8 (client mode) flags control how the peer is polled.

cmd
rem Single public pool
w32tm /config /manualpeerlist:"pool.ntp.org" /syncfromflags:MANUAL /reliable:NO /update
net stop W32Time && net start W32Time
w32tm /resync

Output:

css
The command completed successfully.
The Windows Time service is stopping.
The Windows Time service was stopped successfully.
The Windows Time service is starting.
The Windows Time service was started successfully.
Sending resync command to local computer
The command completed successfully.
cmd
rem Multiple peers, each tagged 0x9 = SpecialInterval + Client
w32tm /config /manualpeerlist:"0.pool.ntp.org,0x9 1.pool.ntp.org,0x9 2.pool.ntp.org,0x9 3.pool.ntp.org,0x9" /syncfromflags:MANUAL /update

Output:

bash
The command completed successfully.
cmd
rem On a domain controller: sync from the domain hierarchy instead
w32tm /config /syncfromflags:DOMHIER /update

Output:

bash
The command completed successfully.

Measuring drift (stripchart)

/stripchart polls a peer repeatedly and prints a one-line offset sample per request. Use it to confirm a peer is reachable, to watch drift over a few minutes, or to bake into a monitoring check.

cmd
rem 10 samples, 2 seconds apart
w32tm /stripchart /computer:pool.ntp.org /samples:10 /period:2

Output:

makefile
Tracking pool.ntp.org [193.0.14.129:123].
The current time is 5/24/2026 10:14:22 AM.
10:14:22, +00.0012345s
10:14:24, +00.0008976s
10:14:26, +00.0010432s
10:14:28, +00.0011110s
10:14:30, +00.0009998s
10:14:32, +00.0010876s
10:14:34, +00.0012001s
10:14:36, +00.0009543s
10:14:38, +00.0011200s
10:14:40, +00.0010500s
cmd
rem ASCII chart with offset graph
w32tm /stripchart /computer:pool.ntp.org /samples:5 /dataonly

Output:

makefile
10:14:22, +00.0012345s
10:14:24, +00.0008976s
10:14:26, +00.0010432s
10:14:28, +00.0011110s
10:14:30, +00.0009998s

Monitoring multiple peers

/monitor takes one sample each from a list of computers — useful for verifying that several DCs all converge to the same stratum-1 source.

cmd
w32tm /monitor /computers:dc01.contoso.local,dc02.contoso.local,pool.ntp.org

Output:

yaml
dc01.contoso.local[192.168.1.10:123]:
    ICMP: 0ms delay
    NTP: -0.0012345s offset from local clock
        RefID: pool.ntp.org [193.0.14.129]
        Stratum: 2

dc02.contoso.local[192.168.1.11:123]:
    ICMP: 1ms delay
    NTP: -0.0008765s offset from local clock
        RefID: dc01.contoso.local [192.168.1.10]
        Stratum: 3

pool.ntp.org[193.0.14.129:123]:
    ICMP: 18ms delay
    NTP: +0.0010432s offset from local clock
        RefID: GPS  [GPS]
        Stratum: 1

Recovering a broken service

When /query /status fails or the service refuses to start, the nuclear option is /unregister && /register. This wipes the registry config back to defaults; you must re-apply your NTP peers afterwards.

cmd
net stop W32Time
w32tm /unregister
w32tm /register
net start W32Time
w32tm /resync /rediscover

Output:

css
The Windows Time service is stopping.
The Windows Time service was stopped successfully.
W32Time successfully unregistered.
W32Time successfully registered.
The Windows Time service is starting.
The Windows Time service was started successfully.
Sending resync command to local computer
The command completed successfully.

Common pitfalls

  1. tzutil doesn't change the clock — only the displayed timezone. The hardware clock is unchanged; if it was wrong before, it's still wrong after. Use w32tm /resync to fix the actual time.
  2. w32tm /resync can fail silently if clock is way off — when the local clock is more than MaxAllowedPhaseOffset (default 300 seconds) from the source, the service refuses to slew it. Set the clock manually with Set-Date first, then resync, or temporarily raise MaxAllowedPhaseOffset.
  3. MaxPosPhaseCorrection / MaxNegPhaseCorrection are the real ceiling — even with a small offset, samples beyond these limits (default 0xFFFFFFFF = unbounded for domain controllers, 54000s for others) are rejected. 54000s is a clue that domain configuration may be needed.
  4. Domain-joined boxes ignore /manualpeerlist — by default they sync from the domain hierarchy. Setting /syncfromflags:MANUAL on a domain member overrides this but is usually wrong; only the PDC emulator should sync from external NTP, and only it should run /reliable:YES.
  5. net stop W32Time && net start W32Time is required after /config — /update reloads some settings but a full restart guarantees every parameter takes effect.
  6. Firewall blocks UDP 123 — NTP uses UDP/123 in both directions; many corporate egress firewalls block it, silently breaking external pool sync. Test with w32tm /stripchart /computer:pool.ntp.org.
  7. tzutil zone IDs are not IANA — Windows uses its own names ("Pacific Standard Time" for America/Los_Angeles). The Get-TimeZone cmdlet's .Id is the canonical name to use with /s.
  8. Hyper-V time integration overrides everything — a VM with Time Synchronization Services enabled gets its clock from the host hypervisor every few seconds, ignoring w32tm. Disable the integration component in Hyper-V Manager or via PowerShell to let w32tm work.
  9. Last Successful Sync Time lies for the first 15 minutes after boot — until the first poll completes the field still shows a value but Time since Last Good Sync Time reflects the boot age. Look at the latter.
  10. SpecialPollInterval is in seconds, MinPollInterval/MaxPollInterval are powers of 2 — MinPollInterval: 6 means 2^6 = 64 seconds, not 6 seconds. SpecialPollInterval: 1024 is literal seconds.

Real-world recipes

Fix a server whose clock has drifted enough to fail Kerberos

Symptom: klist returns KRB_AP_ERR_SKEW, application logons fail, Event Viewer is full of Kerberos event 31. The clock is more than five minutes off the DC.

cmd
rem 1. Confirm the offset
w32tm /stripchart /computer:dc01.contoso.local /samples:3 /dataonly

Output:

makefile
10:14:22, +00:08:42.1234567s
10:14:24, +00:08:42.1287654s
10:14:26, +00:08:42.1342111s
cmd
rem 2. If offset > 5 min, raise the discipline cap or set manually
sc query W32Time
w32tm /config /update /maxposphasecorrection:172800 /maxnegphasecorrection:172800
net stop W32Time && net start W32Time
w32tm /resync /rediscover

Output:

sql
SERVICE_NAME: W32Time
        STATE              : 4  RUNNING
The command completed successfully.
The Windows Time service is stopping.
The Windows Time service was stopped successfully.
The Windows Time service is starting.
The Windows Time service was started successfully.
Sending resync command to local computer
The command completed successfully.
cmd
rem 3. Verify it stuck
w32tm /query /status

Output:

yaml
Leap Indicator: 0(no warning)
Stratum: 3 (secondary reference - syncd by (S)NTP)
Source: dc01.contoso.local
Last Successful Sync Time: 5/24/2026 10:15:08 AM

Configure a Hyper-V host to act as an authoritative NTP server

The PDC emulator (or a single time server in a small environment) syncs from external pools and serves the rest of the domain.

cmd
rem 1. Point at external pools
w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9" /syncfromflags:MANUAL /reliable:YES /update

rem 2. Open UDP 123 inbound
netsh advfirewall firewall add rule name="NTP-IN" dir=in action=allow protocol=UDP localport=123

rem 3. Restart and verify
net stop W32Time && net start W32Time
w32tm /query /status

Output:

less
The command completed successfully.
Ok.
The Windows Time service is stopping.
The Windows Time service was stopped successfully.
The Windows Time service is starting.
The Windows Time service was started successfully.
Stratum: 2 (secondary reference - syncd by (S)NTP)
Source: time.windows.com

Set the timezone and force a resync in one provisioning script

A new image rolling out to an East-Coast office.

cmd
@echo off
echo Setting timezone...
tzutil /s "Eastern Standard Time"
tzutil /g
echo Syncing clock...
w32tm /resync /rediscover
echo Done.

Output:

bash
Setting timezone...
Eastern Standard Time
Syncing clock...
Sending resync command to local computer
The command completed successfully.
Done.

Monitor drift continuously and alert on > 1 second

A simple cmd-line check suitable for a scheduled task that pages on excess drift.

cmd
@echo off
for /f "tokens=2 delims=, " %%t in ('w32tm /stripchart /computer:dc01.contoso.local /samples:1 /dataonly ^| findstr /R "^[0-9]"') do (
    set OFFSET=%%t
)
echo Current offset: %OFFSET%
echo %OFFSET% | findstr /R /C:"^[+-]00:00:0[0-9]" >NUL
if errorlevel 1 (
    echo DRIFT ALERT — offset is %OFFSET%
    exit /b 1
)
exit /b 0

Output:

sql
Current offset: +00:00:00.0012345s

Audit: which NTP source is every box on the fleet using?

Iterate hostnames, query each remote service via w32tm /query /source /computer:<host>.

cmd
@echo off
echo "Host","Source" > sources.csv
for /f "delims=" %%h in (hostlist.txt) do (
    for /f "delims=" %%s in ('w32tm /query /source /computer:%%h 2^>NUL') do (
        echo "%%h","%%s" >> sources.csv
    )
)
type sources.csv

Output:

arduino
"Host","Source"
"MYHOST","dc01.contoso.local"
"SRV01","dc01.contoso.local"
"SRV02","Local CMOS Clock"

The Local CMOS Clock rows are the ones to investigate — that machine isn't actually syncing.

Save a snapshot of full time config (for support tickets)

Dumps everything a Microsoft support engineer would ask for in one go.

cmd
@echo off
set OUT=%TEMP%\timesnap_%COMPUTERNAME%.txt
echo === tzutil /g === > %OUT%
tzutil /g >> %OUT%
echo. >> %OUT%
echo === w32tm /query /status /verbose === >> %OUT%
w32tm /query /status /verbose >> %OUT%
echo. >> %OUT%
echo === w32tm /query /configuration === >> %OUT%
w32tm /query /configuration >> %OUT%
echo. >> %OUT%
echo === w32tm /query /peers === >> %OUT%
w32tm /query /peers >> %OUT%
echo Snapshot saved to %OUT%

Output:

css
Snapshot saved to C:\Users\Alice\AppData\Local\Temp\timesnap_MYHOST.txt

Windows 11 24H2/25H2 — Secure Time Seeding caveat

Windows 11 24H2 ships Secure Time Seeding (STS), which derives an initial clock estimate from TLS-handshake ServerHello.Random values before the first NTP poll. Most of the time STS is harmless, but on machines that wake from a long power-off or have an unreliable RTC, STS can pre-seed the clock several minutes off the real time — and w32tm /resync then refuses to discipline a sample that far away. The symptom is "Windows 11 clock is wrong after the system has been off for a few hours". Disable STS with the registry value HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config\UtilizeSslTimeData = 0 on machines that don't need it (typical for VMs and always-online workstations).

cmd
reg add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config" /v UtilizeSslTimeData /t REG_DWORD /d 0 /f
net stop W32Time && net start W32Time
w32tm /resync /rediscover

Output:

css
The operation completed successfully.
The Windows Time service is stopping.
The Windows Time service was stopped successfully.
The Windows Time service is starting.
The Windows Time service was started successfully.
Sending resync command to local computer
The command completed successfully.

Sources