Event ID 36 — The time service has not synchronized the system time for the last UnsynchronizedTimeSeconds seconds because none of the time service providers provided a usable time stamp.

Message #

The time service has not synchronized the system time for the last %1 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients after %2 seconds. The time service will continue to retry and sync time with its time sources. Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization. You can control the frequency of the time source rediscovery using ClockHoldoverPeriod W32time config setting. Modify the EventLogFlags W32time config setting if you wish to disable this message.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Time-Service",
    "guid": "06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB",
    "event_source_name": "",
    "event_id": 36,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2016-09-17T22:53:43.100250Z",
    "event_record_id": 7768,
    "correlation": {},
    "execution": {
      "process_id": 860,
      "thread_id": 3624
    },
    "channel": "System",
    "computer": "IE10Win7",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "UnsynchronizedTimeSeconds": 86400
  }
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline