{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/", "slug": "dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples", "url": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/" }, "title": "Check W32time when reviewing Azure host-time samples", "summary": "DSE recommends recording service state, configured providers, and the currently selected time source as separate observations.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:56+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 215, "potentially_affected": "This guide is for an investigation of Windows VM time behavior in Azure where host integration is part of the configured synchronization design.", "dse_recommendation": "DSE recommends recording service state, configured providers, and the currently selected time source as separate observations.", "primary_source": { "name": "Time sync for Windows VMs in Azure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/windows/time-sync", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft explains that VMICTimeSync sample mode requires W32time to be running and supplies host samples to that service. The integration service influences the guest clock only forward. Windows Azure Marketplace images default to using both host time and time.windows.com. Microsoft Learn

\n

Applicability

\n

This guide is for an investigation of Windows VM time behavior in Azure where host integration is part of the configured synchronization design.

\n

DSE recommendation

\n

DSE recommends recording service state, configured providers, and the currently selected time source as separate observations. Review W32time before assuming that the host integration service alone supplies the expected ongoing synchronization behavior. Include domain membership and the organization’s time hierarchy in the investigation context, and keep any provider change subject to the established time-service design. Avoid changing several time settings simultaneously while the original symptom is still being characterized.

\n

Verification

\n

Use the documented Windows time inspection commands to capture configuration and the active source, then compare those observations with the intended design. After an approved correction, observe clock behavior over a representative period and record the result. Keep a service-running state separate from measured time agreement, and preserve unresolved drift or source-selection findings for follow-up.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft explains that VMICTimeSync sample mode requires W32time to be running and supplies host samples to that service. The integration service influences the guest clock only forward. Windows Azure Marketplace images default to using both host time and time.windows.com. Microsoft Learn\nApplicability\nThis guide is for an investigation of Windows VM time behavior in Azure where host integration is part of the configured synchronization design.\nDSE recommendation\nDSE recommends recording service state, configured providers, and the currently selected time source as separate observations. Review W32time before assuming that the host integration service alone supplies the expected ongoing synchronization behavior. Include domain membership and the organization’s time hierarchy in the investigation context, and keep any provider change subject to the established time-service design. Avoid changing several time settings simultaneously while the original symptom is still being characterized.\nVerification\nUse the documented Windows time inspection commands to capture configuration and the active source, then compare those observations with the intended design. After an approved correction, observe clock behavior over a representative period and record the result. Keep a service-running state separate from measured time agreement, and preserve unresolved drift or source-selection findings for follow-up.\nOfficial references\n\nMicrosoft: Time sync for Windows VMs in Azure – Azure Virtual Machines | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft explains that VMICTimeSync sample mode requires W32time to be running and supplies host samples to that service. The integration service influences the guest clock only forward. Windows Azure Marketplace images default to using both host time and time.windows.com. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/time-sync)\n\n## Applicability\n\nThis guide is for an investigation of Windows VM time behavior in Azure where host integration is part of the configured synchronization design.\n\n## DSE recommendation\n\nDSE recommends recording service state, configured providers, and the currently selected time source as separate observations. Review W32time before assuming that the host integration service alone supplies the expected ongoing synchronization behavior. Include domain membership and the organization’s time hierarchy in the investigation context, and keep any provider change subject to the established time-service design. Avoid changing several time settings simultaneously while the original symptom is still being characterized.\n\n## Verification\n\nUse the documented Windows time inspection commands to capture configuration and the active source, then compare those observations with the intended design. After an approved correction, observe clock behavior over a representative period and record the result. Keep a service-running state separate from measured time agreement, and preserve unresolved drift or source-selection findings for follow-up.\n\n## Official references\n\n- [Microsoft: Time sync for Windows VMs in Azure – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/time-sync)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/", "url": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check W32time when reviewing Azure host-time samples", "item": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/", "url": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/", "headline": "Check W32time when reviewing Azure host-time samples", "description": "DSE recommends recording service state, configured providers, and the currently selected time source as separate observations.", "abstract": "DSE recommends recording service state, configured providers, and the currently selected time source as separate observations.", "articleBody": "Source facts\nMicrosoft explains that VMICTimeSync sample mode requires W32time to be running and supplies host samples to that service. The integration service influences the guest clock only forward. Windows Azure Marketplace images default to using both host time and time.windows.com. Microsoft Learn\nApplicability\nThis guide is for an investigation of Windows VM time behavior in Azure where host integration is part of the configured synchronization design.\nDSE recommendation\nDSE recommends recording service state, configured providers, and the currently selected time source as separate observations. Review W32time before assuming that the host integration service alone supplies the expected ongoing synchronization behavior. Include domain membership and the organization’s time hierarchy in the investigation context, and keep any provider change subject to the established time-service design. Avoid changing several time settings simultaneously while the original symptom is still being characterized.\nVerification\nUse the documented Windows time inspection commands to capture configuration and the active source, then compare those observations with the intended design. After an approved correction, observe clock behavior over a representative period and record the result. Keep a service-running state separate from measured time agreement, and preserve unresolved drift or source-selection findings for follow-up.\nOfficial references\n\nMicrosoft: Time sync for Windows VMs in Azure – Azure Virtual Machines | Microsoft Learn", "datePublished": "2026-09-17T16:31:56+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check W32time when reviewing Azure host-time samples" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 215, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Time sync for Windows VMs in Azure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/windows/time-sync" } } ] } }