Windows Time

Windows ServiceMicrosoft Corporation

Also called w32time, windows time service, ntp

WindowsMicrosoft

The Windows time service that keeps the clock in sync with a domain or an NTP source.

What you need to know

This keeps the clock honest. Kerberos and certificates care even if you do not.

W32Time talks to NTP or the domain hierarchy. A drifted clock breaks sign-in and TLS long before you notice the tray time. It is not Windows Update.

Important?: Yes, for logon and certificates
High CPU?: Rare. Check the clock source
Safe to disable?: Clock drift will surprise you later

Feex says

If the clock jumped after a CMOS battery died, I would start W32Time and resync. I would not disable the service to "stop network".

What does this service do?

Display name: Windows Time. Service name: W32Time.

It samples a time source, slews or steps the clock, and publishes status. Domain-joined PCs usually follow the domain hierarchy instead of time.windows.com.

History on Windows

Still present

W32Time shipped with Windows 2000 when Microsoft added Kerberos and needed coherent clocks. It has remained the Windows Time service through XP, Vista, Windows 7, and current Windows 10 and Windows 11. The service name is still W32Time.

Windows Time service history
First shipped as W32Time	Windows 2000 (2000)
Still present	Yes, including Windows 10 and Windows 11
Discontinued	No

Why does Windows need it?

Kerberos tickets, TLS, and file timestamps assume the clock is close. A five-minute skew is enough to fail a domain logon.

When does it run?

It polls on an interval. You should not see a constant high CPU. A spike after resume from sleep is a resync.

Should it always be running?

Automatic or Manual (Trigger Start) both appear on client SKUs. Disabled means the clock only moves with the hardware RTC.

Can I disable it?

Only if you accept drift

Disabling W32Time stops NTP and domain sync. Set the clock by hand if you must test. Turn it back on before you join a domain or use a VPN that checks time.

What happens if I disable it?

The clock drifts. Domain logon and some certificates fail. Scheduled tasks that assume local time still run, but at the wrong UTC.

Process host

W32Time commonly runs inside svchost.exe. See svchost.exe.

Dependencies

Windows Time dependencies
Depends on	RPC
Used by	Domain join, Kerberos, and anything that trusts the OS clock

Resource behavior

CPU: Low
Network: Short NTP polls
Disk: Low
Memory: Small

Common problems

Clock off after a dead CMOS battery

Fix the battery, then w32tm /resync. The service cannot invent a good RTC.

VM time vs host

Hypervisors also inject time. Two sources can fight. That is a VM setting, not a reason to delete W32Time.

Troubleshooting

Safe steps first.

w32tm /query /status

Shows the source. time.windows.com versus the domain PDC is the usual split.

Do not set the clock every hour by hand

Turn the service back on.

Technical details

W32Time technical details
Display name	Windows Time
Service name	W32Time

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: W32Time · Windows Time Service
Microsoft Learn: how W32Time works · NTP and domain hierarchy
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.