Active Directory lives and dies by the clock. Kerberos rejects tickets once skew passes five minutes — breaking logons, replication, and Group Policy — so every domain controller has to keep accurate time, in the right topology: the PDC Emulator syncs from trusted external sources, and every other DC syncs down the domain hierarchy. AD Time Changer sets each DC correctly by role, fixes drift and stuck time services, and manages time zones — on one DC or across the whole domain. This guide explains every button and exactly what it does to your DCs.
OverviewWhat the tool does
AD Time Changer configures Windows Time on your domain controllers from a single console. It does four things:
- Sets the NTP time source by role. It detects the PDC Emulator and offers it external NTP, while every other DC is set to domain-hierarchy sync — the correct topology. Apply to one DC, or push the role-correct config to all DCs at once.
- Sets the time zone. Pick any Windows time zone for a target DC and, optionally, disable automatic time-zone updates so the setting stops reverting.
- Diagnoses the time service. Query a DC’s current source and status, run a stripchart from a DC to the PDC to prove NTP reachability, and force a resync — each in a read-only result window you can copy or export.
- Repairs the time service. When a DC is stuck on “Local CMOS Clock” or “no time data available,” it stops, unregisters, re-registers, restarts, and resyncs
w32time— the standard fix for a new or freshly-recovered DC.
Every change is shown first. Preview NTP and Query Status are read-only — they display the exact w32tm commands and the current state without touching a thing. Apply, Set Time Zone, and Repair each ask for confirmation, then briefly restart the Windows Time service on the target.
SetupBefore you begin
Requirements
ActiveDirectory PowerShell module, used to detect the PDC and enumerate DCs). The app self-elevates via UAC — approve the prompt, because changing time settings needs administrator rights.Installing the AD tools (RSAT) on a workstation
You don’t have to run AD Time Changer on a domain controller — a domain-joined Windows 10/11 admin workstation works too, and keeps tools off the DCs. The one requirement is Microsoft’s Remote Server Administration Tools (RSAT), which supply the ActiveDirectory PowerShell module the tool uses to find the PDC Emulator and list the domain’s DCs. Open Windows PowerShell as Administrator and run:
Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0It pulls from Windows Update / Features on Demand, takes a minute or two, and needs no reboot. On Windows Server, install it with Install-WindowsFeature RSAT-AD-Tools; on a domain controller the module is already present. To use a remote Target DC or the all-DCs action from a workstation, the target DCs also need WinRM enabled (Enable-PSRemoting, on by default on modern Windows Server).
RSAT supplies the module, but querying Active Directory still needs domain credentials. A workstation signed in with a local account can’t authenticate to AD. Either sign in as a domain user with admin rights, or launch from a local session with runas /netonly /user:YOURDOMAIN\adminuser "C:\Tools\AD-Time-Changer.exe". On a domain controller none of this applies.
What’s in the box
The download is a portable folder — no installer required:
AD-Time-Changer.exe— the application (published by KW Tech Solutions LLC).LICENSE.txtandREADME.txt.
Copy the folder onto a domain controller (or an RSAT-equipped admin box), extract it, and run AD-Time-Changer.exe. Approve the UAC prompt so it runs elevated. On first launch you’re shown the license agreement; the tool won’t proceed until you accept it.
ActivationLicensing & activation
AD Time Changer is licensed to run — a valid license key is required before any action will work. There is no free-run mode. You enter your key once and it’s remembered on that host.
On launch, the license state is shown at the top-right. Until you activate it reads Not activated — enter your license key to enable, the Activate… button is shown, and every action button (Preview, Apply, Set Time Zone, and the four diagnostics) is disabled. Click Activate… and paste the license key from your purchase confirmation.
On success you’re confirmed activated, the status turns to a green Licensed, the Activate button disappears, and every action unlocks.
Activation is a one-time online step — after it succeeds, the tool runs offline and doesn’t phone home again. Each license includes 2 activations (up to two machines). If you need to move your license to a new machine, or you’ve used both activations, email [email protected] and we’ll reset it for you. You can buy AD Time Changer from its page at kingwerx.com.
LayoutThe main window
The console is one screen, in two columns. The left column drives the NTP time source; the right column shows the current time status and holds the time-zone and diagnostics controls. A live activity log runs across the bottom.
WorkflowA typical time fix, start to finish
Time is the one thing Active Directory cannot tolerate being wrong: once clock skew passes five minutes, Kerberos starts rejecting tickets. The order below is what keeps a fix from becoming an outage.
w32tm commands, read-only, and changes nothing. Read them — they are the whole change.You are responsible for maintaining a current, tested FULL SYSTEM BACKUP of every machine this tool changes. A configuration export, or any output this tool produces, is not a backup. Separately, this tool keeps no copy of your previous time configuration — Query Status is how you capture that, and the result window has Copy and Export buttons for exactly that reason. Do both before the first change, not after something looks wrong.
ActionSetting the NTP time source
This is the core job: pointing each DC at the right time source. The rule is simple — only the PDC Emulator should sync from external sources; every other DC should sync from the domain hierarchy (its parent in the domain). AD Time Changer applies that rule for you.
Choose the mode
w32tm /config /syncfromflags:domhier). No server list is needed.External NTP options
pool.ntp.org, time.nist.gov, time.windows.com, …). Two solid public servers are on by default.w32tm peer flag. 0x9 (SpecialInterval + Client) is the recommended default for a PDC. 0x1 is client-only; 0x8 is SpecialInterval only.Preview, then apply
Click Preview NTP to see the exact w32tm commands the tool will run — a read-only window, nothing is changed. Check the peer list and flags here before committing.
Click Apply NTP to run them. You’re asked to confirm first; applying sets the source, then briefly restarts the Windows Time service on the target and forces a resync. Progress streams into the activity log and the result opens in its own window.
Apply to ALL DCs at once
Tick Apply NTP to ALL DCs to push the role-correct configuration across the whole domain in one action: the tool sends the PDC Emulator your external-NTP config and sets every other DC to domain-hierarchy sync — automatically, no per-DC fiddling. It confirms the count first.
w32tm commands. Note the PDC gets /manualpeerlist and the others get /syncfromflags:domhier — the role split, visible.Applying briefly stops and starts w32time on each targeted DC. It’s quick and routine, but it is a real change — which is why every Apply asks you to confirm, and why Preview lets you check the commands first. Requires WinRM on the remote DCs for the all-DCs action.
ActionSetting the time zone
The Time Zone panel sets the Windows time zone on the Target DC selected in the Diagnostics panel below it (default: this machine). Pick a zone from the list and click Set Time Zone.
ActionDiagnostics & repair
The Diagnostics & Repair panel runs against the selected Target DC — This machine (LOCAL) by default, or any DC in the drop-down. The first three are read-only; the fourth is the repair.
Query Status — read-only
Shows the DC’s current time picture: its source (w32tm /query /source), its peers, the full status, and its time zone. This is how you check what a DC is doing before and after a change.
/status, and time zone — in one window you can Copy or Export. Here a freshly-promoted DC is still on the “Local CMOS Clock,” the classic sign it needs a source set (or a repair).Test NTP (to PDC) — read-only
Runs a stripchart from the target DC to the PDC Emulator (w32tm /stripchart /samples:3 /dataonly) — a quick, read-only proof that the DC can actually reach its time source and see the offset. If this returns offsets, NTP connectivity is healthy; if it times out, the DC can’t reach the PDC.
Force Resync — nudge
Tells the target to resync now (w32tm /resync /rediscover) and re-queries the source. Use it after setting a source, or to prod a DC that has drifted. If it reports “no time data available” and the source stays on Local CMOS Clock, the time service is stuck — that’s what Repair is for.
Repair Service — changes the service
The heavy fix for a broken time service. It stops w32time, unregisters and re-registers it, starts it again, and forces a resync — the standard cure for a DC stuck on “Local CMOS Clock” or reporting “no time data available,” which commonly happens on a newly-promoted or freshly-recovered domain controller.
OutputThe activity log & result windows
Three places show you what happened — and one of them writes itself:
- The activity log across the bottom narrates every action live, colour-coded — green for success, amber for warnings, red for errors — each line stamped with the time. It’s a running record of the session.
- Result windows open for Preview, Query, Test, Resync, Apply, and Repair. Each holds the full command output and has Copy and Export… buttons — save a Query or a stripchart as a text file for a change ticket, a client record, or a before/after comparison.
- An automatic session log. Every line that appears on screen is also appended, as it happens, to
%ProgramData%\KWTechSolutions\ADTimeChanger\logs\session-<timestamp>.log, headed with the version, the machine and the user who ran it. Written line by line, so the record survives closing the tool or a crash mid-run — you do not have to remember to save anything. Nothing is transmitted anywhere; the file stays on that machine.
Run Query Status and Export it before a change, make the change, then Query and Export again. Side by side, the two files show exactly what moved — a tidy record that the DC’s time is now correct.
ReferenceTroubleshooting
| Symptom | Cause & fix |
|---|---|
| Every action button is greyed out | The tool isn’t activated. Click Activate… (top right) and paste your license key (see Licensing & activation). |
| PDC Emulator shows “unknown” | The ActiveDirectory module isn’t present or AD isn’t reachable. Run on a DC, or install RSAT (see Installing the AD tools) and sign in as a domain user. |
| “could not find a forest…” / “SSPI failed” | You’re signed in with a local account, which can’t authenticate to AD. Sign in as a domain user, or launch with runas /netonly /user:DOMAIN\admin. On a DC this never happens. |
| “Access is denied” when applying | The app wasn’t elevated, or you lack rights on the target DC. Approve the UAC prompt and use a Domain-Admin-class account. |
| All-DCs apply skips a DC / times out | That DC’s WinRM isn’t reachable. Enable PowerShell remoting on it (Enable-PSRemoting) and check the firewall. |
| Source stays “Local CMOS Clock” after Apply / Resync | The time service is stuck — common on a new or recovered DC. Run Repair Service on that DC, then Force Resync. |
| Test NTP times out | The DC can’t reach the PDC over UDP 123, or the PDC has no working external source. Check firewalls and set the PDC to external NTP. |
| Time zone keeps reverting | Automatic time zone is re-detecting it. Re-run Set Time Zone with “disable automatic time zone” ticked. |
LegalLicensing & notices
Your use of the software is governed by the End User License Agreement (LICENSE.txt, shown on first run). In short: AD Time Changer changes time configuration on the DCs you target — each change is confirmed first, and Preview and Query Status are read-only. A valid license key is required to run it, and it is provided “AS IS,” without warranty; KW Tech Solutions LLC is not liable for data loss, service disruption, or authentication issues arising from its use. Only the PDC Emulator should sync from external sources; every other DC should sync from the domain hierarchy. You remain responsible for your environment and your own tested backups.
You are responsible for maintaining a current, tested FULL SYSTEM BACKUP of every machine this software changes, and for verifying the result of any change you apply. A configuration export, or any output this software produces, is not a backup.
Support covers this program only — installation, activation, and the operation of the software itself. It does not extend to your Active Directory, your domain controllers, your time hierarchy, or any system the program touches, and it does not include diagnosing or repairing your environment or the consequences of a change you choose to make.
The About dialog, reachable from the title bar, shows the version, the KingWerx™ brand, the publisher (KW Tech Solutions LLC), and the support address.
Microsoft, Windows, Windows Server, and Active Directory are trademarks of Microsoft Corporation. AD Time Changer is an independent product of KW Tech Solutions LLC and is not affiliated with, authorized, sponsored, or endorsed by Microsoft.