How to configure w32time manual NTP keys across an untrusted forest?

Freya Davies 5 Reputation points
2026-09-10T13:45:31.8433333+00:00

Need to resolve a time synchronisation failure across an untrusted Active Directory forest trust following recent infrastructure changes.

Indicates that symmetric key NTP authentication is persistently rejected by the target time servers.

And our domain controllers need w32time properly configured to utilize manual NTP key configurations. How do we set these parameters correctly?

Windows for business | Windows 365 Business
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest
  1. Hoang Le 4,580 Reputation points Independent Advisor
    2026-09-10T14:26:51.2266667+00:00

    Hello Freya Davies,

    In this case the failure stems from the fact that w32time is still attempting symmetric key NTP authentication across an untrusted forest boundary, which will be rejected unless you explicitly configure manual key associations. The supported procedure is to define the trusted NTP servers and their keys directly in the registry and then force w32time to use them. On each domain controller, set the NtpServer value under HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters to the format server,0x8 and if keys are required, configure them under HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient\SpecialPollInterval and the ManualPeerList. You then run w32tm /config /manualpeerlist:"server1 keyID,0x8 server2 keyID,0x8" /update followed by w32tm /resync /rediscover. The key material itself must be provisioned with w32tm /config /setkey:KeyID,HexKey so that the symmetric authentication succeeds.

    After applying these changes, restart the Windows Time service (net stop w32time && net start w32time) and verify with w32tm /query /status and w32tm /query /peers that the domain controllers are synchronizing against the intended peers with the correct key IDs. This ensures that time sync works reliably even across untrusted forest trusts where default Kerberos‑based time propagation is not possible.

    If my answer is useful for you, please hit Accept the answer to support me.

    Thank you,

    HL.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.