# Event ID : 1 in windows Server 2012

**URL:** <https://community.ntppool.org/t/event-id-1-in-windows-server-2012/1806>\
**Category:** Uncategorized\
**Created:** [October 13, 2020, 6:19am UTC](https://community.ntppool.org/t/event-id-1-in-windows-server-2012/1806 "2020-10-13T06:19:33Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![gobinath1984](https://avatars.discourse-cdn.com/v4/letter/g/ce73a5/32.png) [@gobinath1984](https://community.ntppool.org/u/gobinath1984)\
**Post date:** [October 13, 2020, 6:19am UTC](https://community.ntppool.org/t/event-id-1-in-windows-server-2012/1806/1 "2020-10-13T06:19:33Z")

</div>

Dear Team,

I’m having the query about Event ID : 1 ,

We are having the DC and this DC configured NTP service with **[asia.pool.ntp.org](http://asia.pool.ntp.org)** , some times getting this event **The system time has changed to ‎2020‎-‎10‎-‎10T05:37:50.761128100Z from ‎2020‎-‎10‎-‎10T05:36:29.828443500Z.**  
**Change Reason: An application or system component changed the time.**

But actual time was 10/10/2020 11:07:50 AM .

The server BIOS time zone ‎2020‎-‎10‎-‎10T05:37:50.761128100Z ( +0:00 –Greenwich Mean Time ).  
Windows Server time zone (UTC+05:30) Chennai, Kolkata, Mumbai, New Delhi .

My queries are given below,

1. May i know the root cause of this event with above scenario ?

2. If this condition what impact will happen for DC clients ?

3. How to sync windows time with BIOS ?

4. If BIOS & Windows times are differ what impact will happen ?

Requesting you to kindly share your input for above concern quires .

Regards,  
Gobinath G

---

<div class="post-metadata">

**Author:** ![studentmain](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/studentmain/32/354_2.png) [@studentmain](https://community.ntppool.org/u/studentmain)\
**Post date:** [October 14, 2020, 3:34pm UTC](https://community.ntppool.org/t/event-id-1-in-windows-server-2012/1806/2 "2020-10-14T15:34:06Z")

</div>

1. It’s a normal log when your system try to modify time to sync with ntppool (or other ntp server)
2. Client will sync with DC
3. 11:07-05:37=05:30, so it’s already synced.
4. Windows will use BIOS time when booting, when OS time is modified, Windows write modified time to BIOS.

---

<div class="post-metadata">

**Author:** ![gobinath1984](https://avatars.discourse-cdn.com/v4/letter/g/ce73a5/32.png) [@gobinath1984](https://community.ntppool.org/u/gobinath1984)\
**Post date:** [November 2, 2020, 6:29am UTC](https://community.ntppool.org/t/event-id-1-in-windows-server-2012/1806/3 "2020-11-02T06:29:52Z")

</div>

Dear Team,

I have a query , for testing purpose we shutdown the internal NTP server , after a day each client showing with different times. May i know why it’s shows like that .

If time server communication dropped it should be continue with last synced time or it from take which source ?

---

<div class="post-metadata">

**Author:** ![NTPman](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ntpman/32/450_2.png) [@NTPman](https://community.ntppool.org/u/NTPman)\
**Post date:** [November 2, 2020, 7:17am UTC](https://community.ntppool.org/t/event-id-1-in-windows-server-2012/1806/4 "2020-11-02T07:17:09Z")

</div>

> [@gobinath1984](#):
>
> after a day each client showing with different times

How much time difference do the clients have to each other?

---

<div class="post-metadata">

**Author:** ![gobinath1984](https://avatars.discourse-cdn.com/v4/letter/g/ce73a5/32.png) [@gobinath1984](https://community.ntppool.org/u/gobinath1984)\
**Post date:** [November 3, 2020, 5:03am UTC](https://community.ntppool.org/t/event-id-1-in-windows-server-2012/1806/5 "2020-11-03T05:03:47Z")

</div>

minimum 4 seconds , maximum 1 min.

---

<div class="post-metadata">

**Author:** ![NTPman](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ntpman/32/450_2.png) [@NTPman](https://community.ntppool.org/u/NTPman)\
**Post date:** [November 3, 2020, 7:22am UTC](https://community.ntppool.org/t/event-id-1-in-windows-server-2012/1806/6 "2020-11-03T07:22:37Z")

</div>

When you shutdown your internal NTP sever, the clients has no time source any more. So their clocks are free running, that explains the time drift.

---

<div class="post-metadata">

**Author:** ![gobinath1984](https://avatars.discourse-cdn.com/v4/letter/g/ce73a5/32.png) [@gobinath1984](https://community.ntppool.org/u/gobinath1984)\
**Post date:** [November 3, 2020, 11:04am UTC](https://community.ntppool.org/t/event-id-1-in-windows-server-2012/1806/7 "2020-11-03T11:04:29Z")

</div>

okay , noted … And i have following three queries , kindly guide me .

1. is can not control the clock free running , while NTP server down ?

2. How to monitoring the NTP server which is pointed to internet ?

3. How to monitoring the NTP server which is pointed to intranet ?
