---
title: Windows Time Service Synchronization
description: "*Windows Server time sync with SecureSchool for reliable authentication.* #### Summary For authentication to function correctly (NTLM or Kerberos), the **SecureSchool appliance and your Windows domain controller must remain within 5 minutes of each other.** - SecureSchool synchronizes its clock…"
url: "https://www.k12usa.com/docs/windows-time-service-synchronization/"
updated: "2025-09-18"
category: SecureSchool
tags:
  - ISBossBox
  - LibraryDoor
  - Microsoft Windows
  - SecureSchool
---

# Windows Time Service Synchronization

*Windows Server time sync with SecureSchool for reliable authentication.*

#### Summary

For authentication to function correctly (NTLM or Kerberos), the **SecureSchool appliance and your Windows domain controller must remain within 5 minutes of each other.**

- SecureSchool synchronizes its clock with authoritative US Navy NTP servers through our K12USA office.
- Your **domain controller(s)** must be configured to use SecureSchool as their authoritative time source.
- Once configured, all **workstations and member servers** on your domain will automatically sync from the domain controller.

**Why this matters:** If time is out of sync, **NTLM and Kerberos authentication can fail,** preventing users from logging in or applying the correct filter sets. Proper time synchronization is critical for SecureSchool to authenticate users reliably.

#### Windows Server 2016, 2019, or 2022

To configure a modern Windows Server domain controller:

1. Open a Command Prompt (Run as Administrator) on your domain controller.
2. Enter the following commands (replace 10.0.0.1 with the IP address of your SecureSchool appliance):
   ```
   w32tm /config /manualpeerlist:10.0.0.1 /syncfromflags:manual /update
   net stop w32time
   net start w32time
   ```
3. Verify synchronization by running:
   ```
   w32tm /query /status
   ```

You should see SecureSchool listed as the time source.

#### Windows Server 2008 (Legacy Environments)

If you are still running Windows Server 2008, the same commands apply as above:

```
w32tm /config /manualpeerlist:10.0.0.1 /syncfromflags:manual /update
net stop w32time
net start w32time
```

#### Windows 2000 / 2003 (Obsolete)

While these systems are long out of support, the legacy method is:

```
net time /setsntp:10.0.0.1
net stop w32time
net start w32time
```

**Note:** If you are still on Windows 2000 or 2003, we strongly recommend upgrading, as these platforms no longer receive Microsoft security updates.

#### Important Notes

- Configure all domain controllers to use the same authoritative time source. If only some are configured, they may conflict and cause time synchronization issues.
- After setup, verify time sync periodically using:
  ```
  w32tm /monitor
  ```

#### References

- Microsoft: [Windows Time Service Tools and Settings](https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings)

With this configuration, SecureSchool and your Windows servers will stay synchronized, ensuring authentication works reliably across your network.