After working with Linux servers for over a decade, I feel safe saying that many server tasks on a modern linux distribution are incredibly simple nowadays. Unfortunately for me, I've recently had to move into administering Windows Servers and I've found the transition to be a lot harder than I initially thought. I keep running into things that are so simple on Ubuntu they can be installed and configured with a one-liner terminal command, but end up being a four or five step process in Windows Server of clicking between windows and entering information.

Case in point: enabling and configuring the NTP Server on Windows.

Even the naming is arbitrarily more complicated! In linux, you'll be looking for "ntpd" (literally 'Network Time Protocol Daemon'), but Windows uses the Windows Time Service (W32Time). 

On Ubuntu/Debian based distros, installing and activating ntpd is basically:

apt install ntp && systemctl enable ntp && [command to open port 123 for your firewall]

On Windows Server, the full checklist is:

• Enable Windows Time Service
• Configure it as a reliable time source
• Set registry keys for NTPServer
• Enable NTP Server in Group Policy
• Restart the service (or reboot)
• Open UDP 123 in the firewall

I get it... Microsoft expects that your servers and clients will be on the internet to sync with time.windows.com and, in an intranet environment, they expect you to have a domain controller which would enforce a single NTP across the directory. Still (even in 2025), it's not terribly uncommon to end up in a situation like mine where you have a single purpose application running as an 'appliance' that operates across it's own isolated network. In this scenario, I just want to enable NTP to keep the application running smoothly between the server and clients.

I couldn't find these steps succinctly written out anywhere else, so (besides venting to satisfy my own sanity) I am writing them here to hopefully help you or myself if we have to do this again.

Setting Up A Windows NTP Server Step-by-Step

✅ Step 1: Ensure Windows Time Service is Running

• On the Windows Server, open Services (services.msc)
• Locate Windows Time
• Make sure it’s Running and set to Automatic (mine defaulted to stopped and disabled)

✅ Step 2: Configure the Server as an NTP Server

• Open Command Prompt or PowerShell as Administrator.
• Run the following commands:
  • w32tm /config /manualpeerlist:"" /syncfromflags:manual /reliable:YES /update
  • net stop w32time
  • net start w32time
• manualpeerlist:"" is empty because the server won’t sync from external sources.
  • If you have a GPS device or another time syncing device, you might put it's IP in this location.
• /reliable:YES marks this machine as a reliable time source.

✅ Step 3: Enable NTP Server Functionality

By default, Windows Time Service doesn't respond to NTP requests, so you need to enable it in the registry:

• Open Registry Editor (regedit).
• Navigate to:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer
• Set Enabled to 1
• Confirm AnnounceFlags set to 5 under:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
  • AnnounceFlags at 5 (means "always a time server"). Some other possible values for this key are here.
• Restart the Windows Time service:
  net stop w32time && net start w32time

✅ Step 4: Enable NTP Server in Group Policy

My Windows Server install defaulted to NTP Server being disabled in Group Policy. I had to do the following:

• Run gpedit.msc → Computer Configuration → Administrative Templates → System → Windows Time Service → Time Providers
  • Make sure Enable Windows NTP Server is set to Enabled

✅ Step 5: Open Firewall for NTP

If Windows Firewall is enabled, run this command from PowerShell:

• netsh advfirewall firewall add rule name="NTP Server" dir=in action=allow protocol=UDP localport=123

✅ Step 6: Configure Workstations to Sync with the Server

On each Windows 11 client:

• Enable Automatic Time Sync tick mark from Date and Time Settings if it isn't enabled by default.
• w32tm /config /manualpeerlist:"<Server_IP>" /syncfromflags:manual /update
  • Replace <Server_IP> with your Windows Server’s IP address.
  • /syncfromflags:manual is telling w32tm to reference the manualpeerlist.
• net stop w32time
• net start w32time
• w32tm /resync

✅ Step 7: Trust, but Verify

On the server:  w32tm /query /configuration

On a client:  w32tm /query /status

You should see the client pointing to the server as its time source and the server configuration should report "Enabled: 1" in it's output.

That Group Policy step was missing from the other guides I found and took me an hour or so to troubleshoot. A few other helpful troubleshooting steps are:

• netstat -an | find --% "123"
  • This command should show that your server is listening for packets on the NTP port 123
• Open the Event Viewer, then browse to Windows Logs → System → Source: W32Time

Hopefully this saves you the frustration I went through. If you have other tips or run into issues, drop a comment!

And if this helped you out of a bind, leave a tip or share it.