# Check W32time when reviewing Azure host-time samples

> DSE recommends recording service state, configured providers, and the currently selected time source as separate observations.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:56+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends recording service state, configured providers, and the currently selected time source as separate observations.

## Potentially affected

This guide is for an investigation of Windows VM time behavior in Azure where host integration is part of the configured synchronization design.

## DSE recommendation

DSE recommends recording service state, configured providers, and the currently selected time source as separate observations.

## Article

## Source facts

Microsoft explains that VMICTimeSync sample mode requires W32time to be running and supplies host samples to that service. The integration service influences the guest clock only forward. Windows Azure Marketplace images default to using both host time and time.windows.com. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/time-sync)

## Applicability

This guide is for an investigation of Windows VM time behavior in Azure where host integration is part of the configured synchronization design.

## DSE recommendation

DSE recommends recording service state, configured providers, and the currently selected time source as separate observations. Review W32time before assuming that the host integration service alone supplies the expected ongoing synchronization behavior. Include domain membership and the organization’s time hierarchy in the investigation context, and keep any provider change subject to the established time-service design. Avoid changing several time settings simultaneously while the original symptom is still being characterized.

## Verification

Use the documented Windows time inspection commands to capture configuration and the active source, then compare those observations with the intended design. After an approved correction, observe clock behavior over a representative period and record the result. Keep a service-running state separate from measured time agreement, and preserve unresolved drift or source-selection findings for follow-up.

## Official references

- [Microsoft: Time sync for Windows VMs in Azure – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/time-sync)

## Primary reference

- Name: Time sync for Windows VMs in Azure - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/time-sync
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check W32time when reviewing Azure host-time samples,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-184-check-w32time-when-reviewing-azure-host-time-samples/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.