windows_exporter/docs/runbooks/windowsclocksourcelocal.md

title

title
WindowsClockSourceLocal

Meaning

Windows Time reports Local CMOS Clock or NoSync as the source of the system clock for ten minutes. The alert carries the source in its type label. It needs the time collector with its clock_source subcollector and covers domain members too, whose source is NT5DS when they synchronize from the domain hierarchy; the NTP source count of WindowsClockNotSynchronising does not see those hosts. A host that is meant to be the free-running reference of an isolated network reports the local clock by design; exclude it with alerts+: { WindowsClockSourceLocal: false } on that configuration.

Impact

The clock drifts without an external source. Clock errors break Kerberos authentication beyond the five minute tolerance, TLS validation, scheduled work, log correlation and distributed systems that depend on time order.

Diagnosis

1. Inspect windows_time_clock_sync_source for the host, and windows_time_computed_time_offset_seconds to see how far the clock has already drifted.

2. On the host, check the configured and the effective source:

   w32tm /query /source
   w32tm /query /status
   w32tm /query /configuration
   Get-Service W32Time
   

3. Local CMOS Clock after a reboot often means the Windows Time service started before the network was up or the configured peers were unreachable. NoSync means the time provider is configured not to synchronize.

4. For domain members, check that a domain controller is reachable and that the PDC emulator synchronizes from an external source. For virtual machines, check whether hypervisor time integration overrides the configured source. A Hyper-V guest outside a domain that is kept in time by the integration service reports NoSync while w32tm /query /source shows the VM IC Time Synchronization Provider; that is by design, so turn the alert off for such guests with alerts+: { WindowsClockSourceLocal: false } or configure an NTP source in the guest.

Mitigation

Configure the intended source and restart synchronization with w32tm /config /syncfromflags:domhier /update on domain members or w32tm /config /manualpeerlist:"<servers>" /syncfromflags:manual /update on stand-alone hosts, then w32tm /resync /rediscover. Fix network access to the peers over UDP port 123. Confirm the source changes to NT5DS or NTP and the offset returns to normal; follow WindowsClockSkewDetected if it does not.