Another common Windows registry operation is the enumeration of the values under a given registry key. Windows provides the RegEnumValue API (bit.ly/2jB4kaV) for this purpose. Here, I’ll show how to use this API to get a list of the names and types of the values located under a given registry key, wrapping the enumeration process in a.

• Back up the Registry. To do so: Open the Registry Editor by typing regedit into Start and then clicking regedit. Click File in the top-left corner. In the drop-down menu. Enter a name for your Registry backup. Check the 'All' box on the left side of the window.
• To Find Windows Version Number in Registry Editor 1 Press the Win + R keys to open Run, type regedit into Run, and click/tap on OK to open Registry Editor. 2 If prompted by UAC, click/tap on Yes. 3 In the left pane of Registry Editor, browse to the key below. (see screenshot below).

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10

The Windows Time service (W32Time) synchronizes the date and time for all computers managed by Active Directory Domain Services (AD DS). This article covers the different tools and settings used to manage the Windows Time service.

By default, a computer that is joined to a domain synchronizes time through a domain hierarchy of time sources. However, if a computer has been manually configured to synchronize from a specific time source, perhaps because it was formerly not joined to a domain, you can reconfigure the computer to begin automatically sourcing its time from the domain hierarchy.

Most domain-joined computers have a time client type of NT5DS, which means that they synchronize time from the domain hierarchy. An exception to this is the domain controller, which functions as the primary domain controller (PDC) emulator operations master for the root forest domain. The PDC emulator operations master in turn is usually configured to synchronize time with an external time source.

You can achieve down to one-millisecond time accuracy in your domain. For more information, see Support boundary for high-accuracy time and see Accurate Time for Windows Server 2016.

Caution

Don't use the Net time command to configure or set a computer's clock time when the Windows Time service is running.

Also, on older computers that run Windows XP or earlier, the Net time /querysntp command displays the name of a Network Time Protocol (NTP) server with which a computer is configured to synchronize, but that NTP server is used only when the computer's time client is configured as NTP or AllSync. This command has since been deprecated.

Network port

The Windows Time service follows the Network Time Protocol (NTP) specification, which requires the use of UDP port 123 for all time synchronization. Whenever the computer synchronizes its clock or provides time to another computer, it happens over UDP port 123. This port is exclusively reserved by the Windows Time service.

Note

If you have a computer with multiple network adapters (is multi-homed), you cannot enable the Windows Time service based on a network adapter.

Using W32tm.exe

You can use the command-line tool W32tm.exe to configure Windows Time service settings and to diagnose computer time problems. W32tm.exe is the preferred command-line tool for configuring, monitoring, and troubleshooting the Windows Time service. W32tm.exe is included with Windows XP and later and Windows Server 2003 and later.

Membership in the local Administrators group is required to run W32tm.exe locally, while membership in the Domain Admins group is required to run W32tm.exe remotely.

Run W32tm.exe

1. In the Windows search bar, enter cmd.
2. Right-click Command Prompt, then select Run as administrator.
3. At the command prompt, enter w32tm followed by the applicable parameter, as described below:

Set client to use two time servers

To set a client computer to point to two different time servers, one named ntpserver.contoso.com and another named clock.adatum.com, type the following command at the command prompt, and then press ENTER:

Set client to sync time automatically from a domain source

To configure a client computer that is currently synchronizing time using a manually-specified computer to synchronize time automatically from the AD domain hierarchy, run the following following:

Check client time configuration

To check a client configuration from a Windows-based client computer that has a host name of contosoW1, run the following command:

The output of this command displays a list of W32time configuration parameters that are set for the client.

Important

Windows Server 2016 has improved the time synchronization algorithms to align with RFC specifications. Therefore, if you want to set the local time client to point to multiple peers, we recommended that you prepare three or more different time servers.

If you have only two time servers, you should specify the NtpserverUseAsFallbackOnly flag (0x2)to de-prioritize one of them. For example, if you want to prioritize ntpserver.contoso.com over clock.adatum.com, run the following command.

Additionally, you can run the following command and read the value of NtpServer in the output:

Configure computer clock reset

In order for W32tm.exe to reset a computer clock, it first checks the offset (CurrentTimeOffset, also known as Phase Offset) between the current time and the computer clock time to determine whether the offset is less than the MaxAllowedPhaseOffset value.

• CurrentTimeOffset < MaxAllowedPhaseOffset: Adjust the computer clock gradually by using the clock rate.
• CurrentTimeOffset ≥ MaxAllowedPhaseOffset: Set the computer clock immediately.

Then, to adjust the computer clock by using the clock rate, W32tm.exe calculates a PhaseCorrection value. This algorithm varies depending on the version of Windows:

• Windows Server 2016 and later versions:

  PhaseCorrection_raw = |CurrentTimeOffset| ÷ (16 × PhaseCorrectRate × pollIntervalInSeconds)
  MaximumCorrection = |CurrentTimeOffset| ÷ (UpdateInterval × 1,000 × 10,000)
  PhaseCorrection = min(PhaseCorrection_raw, MaximumCorrection)

• Windows Server 2012 R2 and earlier versions:

  PhaseCorrection = |CurrentTimeOffset| ÷ (PhaseCorrectRate × UpdateInterval)

All versions of Windows use the same final equation to check PhaseCorrection:

PhaseCorrection ≤ SystemClockRate ÷ 2

Note

• These equations use PhaseCorrectRate, UpdateInterval, MaxAllowedPhaseOffset, and SystemClockRate measured in units of clock ticks. On Windows systems, 1 ms = 10,000 clock ticks.

• MaxAllowedPhaseOffset is configurable in the registry. However, the registry parameter is measured in seconds instead of clock ticks.

• To see the SystemClockRate and pollIntervalInSeconds values (measured in seconds), open a Command Prompt window and then run W32tm /query /status /verbose. This command produces output that resembles the following.
  The output presents the poll interval in both clock ticks and in seconds. The equations use the value measured in seconds (the value in parentheses).
  The output presents the clock rate in seconds. To see the SystemClockRate value in clock ticks, use the following formula:

  (value in seconds) × 1,000 × 10,000

  For example, if SystemClockRate is 0.0156250 seconds, the value that the equation uses is 156,250 clock ticks.For full descriptions of the configurable parameters and their default values, see Config entries later in this article.

The following examples show how to apply these calculations for Windows Server 2012 R2 and earlier versions.

Example: System clock rate off by four minutes

Your computer clock time is 11:05 and the actual current time is 11:09:

PhaseCorrectRate = 1

UpdateInterval = 30,000 clock ticks

SystemClockRate = 156,000 clock ticks

MaxAllowedPhaseOffset = 10 min = 600 seconds = 600 × 1,000 × 10,000 = 6,000,000,000 clock ticks

|CurrentTimeOffset| = 4 min = 4 × 60 × 1,000 × 10,000 = 2,400,000,000 clock ticks

Is CurrentTimeOffset ≤ MaxAllowedPhaseOffset?

2,400,000,000 ≤ 6,000,000,000: TRUE

AND does it satisfy the following equation?

(|CurrentTimeOffset| ÷ (PhaseCorrectRate × UpdateInterval) ≤ SystemClockRate ÷ 2)

Is 2,400,000,000 / (30,000 × 1) ≤ 156,000 ÷ 2

80,000 ≤ 78,000: FALSE

Therefore, W32tm.exe would set the clock back immediately.

Note

In this case, if you want to set the clock back slowly, you would also have to adjust the values of PhaseCorrectRate or UpdateInterval in the registry to make sure that the equation result is TRUE.

Example: System clock rate off by three minutes

Your computer clock time is 11:05 and the actual current time is 11:08:

PhaseCorrectRate = 1

UpdateInterval = 30,000 clock ticks

SystemClockRate = 156,000 clock ticks

MaxAllowedPhaseOffset = 10 min = 600 seconds = 600 × 1,000 × 10,000 = 6,000,000,000 clock ticks

|CurrentTimeOffset| = 3 mins = 3 × 60 × 1,000 × 10,000 = 1,800,000,000 clock ticks

Is CurrentTimeOffset ≤ MaxAllowedPhaseOffset?

1,800,000,000 ≤ 6,000,000,000: TRUE

AND does it satisfy the following equation?

(|CurrentTimeOffset| ÷ (PhaseCorrectRate × UpdateInterval) ≤ SystemClockRate ÷ 2)

Is 3 mins × (1,800,000,000) ÷ (30,000 × 1) ≤ 156,000 ÷ 2

Is 60,000 ≤ 78,000: TRUE

In this case, the clock will be set back slowly.

Using Local Group Policy Editor

The Windows Time service stores a number of configuration properties as registry entries. You can use Group Policy Objects (GPOs) in Local Group Policy Editor to configure most of this information. For example, you can use GPOs to configure a computer to be an NTPServer or NTPClient, configure the time synchronization mechanism, or configure a computer to be a reliable time source.

Note

Group Policy settings for the Windows Time service can be applied on Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, and Windows Server 2008 R2 domain controllers and can be applied to computers running Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, and Windows Server 2008 R2.

Windows stores the Windows Time service policy information in the Local Group Policy Editor under Computer ConfigurationAdministrative TemplatesSystemWindows Time Service. It stores configuration information that the policies define in the Windows registry, and then uses those registry entries to configure the registry entries specific to the Windows Time service. As a result, the values defined by Group Policy overwrite any pre-existing values in the Windows Time service section of the registry. Some of the preset GPO settings differ from the corresponding default Windows Time service registry entries.

For example, suppose you edit policy settings in the Time ProvidersConfigure Windows NTP Client policy. Windows loads these settings into the policy area of the registry under the following subkey:

Get Windows Version From Registry

HKLMSoftwarePoliciesMicrosoftW32timeTimeProvidersNtpClient

Then Windows uses the policy settings to configure the related Windows Time service registry entries under the following subkey: Bluestacks 1 yukle.

HKLMSYSTEMCurrentControlSetServicesW32TimeTime ProvidersNTPClient

The following table lists the policies that you can configure for the Windows Time service, and the registry subkeys that those policies affect.

Note

When you remove a Group Policy setting, Windows removes the corresponding entry from the policy area of the registry.

¹Category path: Computer ConfigurationAdministrative TemplatesSystemWindows Time Service
² Subkey: HKLMSOFTWAREPoliciesMicrosoft
³ Subkey: HKLMSYSTEMCurrentControlSetServices

Windows registry reference

Warning

This information is provided as a reference for use in troubleshooting and validation. Windows registry keys are used by W32Time to store critical information. Don't change these values. Modifications to the registry are not validated by the registry editor or by Windows before they are applied. If the registry contains invalid values, Windows may experience unrecoverable errors.

The Windows Time service stores information in the registry at the HKLMSYSTEMCurrentControlSetServicesW32Time path under the following subkeys:

In the following tables, 'All versions' refers to Windows 7, Windows 8, Windows 10, Windows Server 2008 and Windows Server 2008 R2, Windows Server 2012 and Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019.

Note

Some of the parameters in the registry are measured in clock ticks and some are measured in seconds. To convert the time from clock ticks to seconds, use these conversion factors:

• 1 minute = 60 sec
• 1 sec = 1000 ms
• 1 ms = 10,000 clock ticks on a Windows system, as described at DateTime.Ticks Property.

For example, 5 minutes becomes 5 × 60 × 1000 × 10000 = 3,000,000,000 clock ticks.

Config entries

The Config subkey entries are located at HKLMSYSTEMCurrentControlSetServicesW32TimeConfig.

Parameters entries

The Parameters subkey entries are located at HKLMSYSTEMCurrentControlSetServicesW32TimeParameters.

NtpClient entries

The NtpClient subkey entries are located at HKLMSYSTEMCurrentControlSetServicesW32TimeTimeProvidersNtpClient

NtpServer entries

The NtpClient subkey entries are located at HKLMSYSTEMCurrentControlSetServicesW32TimeTimeProvidersNtpServer.

Enhanced logging

The following registry entries are not a part of the W32Time default configuration but can be added to the registry to obtain enhanced logging capabilities. The information logged to the System Event log can be modified by changing values for the EventLogFlags setting in the Group Policy Object Editor. By default, the Windows Time service logs an event every time that it switches to a new time source.

In order to enable W32Time logging, add the following registry entries:

Group Policy Object settings

Group Policy settings are contained in the Global Configuration Settings and the Windows NTP Client Settings GPOs.

Global Configuration Settings

These are the global Group Policy settings and default values for the Windows Time service. These settings are contained in the Global Configuration Settings GPO in Local Policy Editor.

Windows NTP Client settings

These are the Windows NTP client settings and default values for the Windows Time service. These settings are contained in the Configure Windows NTP Client GPO in Local Group Policy Editor.

Related information

See RFC 1305 - Network Time Protocol of the Internet Engineering Task Force (IETF).

Starting from its first version, PowerShell offers an administrator an extensive set of tools to interact with Windows system registry. If necessary, all typical operations with the registry can be performed not in the good old Regedit interface, or reg.exe, but in PowerShell command prompt. In different scripts and scenarios it is indispensable. In this article, we’ll consider how to create, edit or delete keys and parameters of Windows registry, search something or connect to the registry on a remote computer using PowerShell.

Registry Navigation Using PowerShell

Working with the registry in PowerShell is similar to working with common files on a local disk.

Display the list of available drives:

get-psdrive

As you can see, the built-in provider allows to get access to the contents of two branches of the registry: HKEY_CURRENT_USER (HKCU) and HKEY_LOCAL_MACHINE (HKLM). The branches of the registry are addressed like drives (HKLM: and HKCU:). For example, to go to the root of HKLM, run this command:

cd HKLM:

You can go to the specific branch of the registry (for example, to the one responsible for the settings of automatic driver updates) using Set-Location command (alias — sl)

Set-Location -Path HKLM:SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching

Display the contents of the key:

dir

Or

Get-ChildItem

Get Windows Product Key From Registry

Open the same branch in the Registry Editor. As you can see, the command has displayed only the information about the subkeys, not the parameters of the current branch.

The matter is that, from PowerShell point of view, a registry branch (a key) is a file analog, and the parameters stored in this registry key are the properties of this file.

So, to get the parameters of this branch, use Get-Item cmdlet:

Get-Item .
Or
Get-Item -Path HKLM:SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching

As you can see, DriverSearching key has only one parameter – SearchOrderConfig with its value equal to 0.

To address the specific key parameter, Get-ItemProperty cmdlet is used. For example, assign the contents of the branch to variable and get the value of the parameter:

$DriverUpdate = Get-ItemProperty –Path ‘HKLM:SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching’
$DriverUpdate.SearchOrderConfig

We have got that the value of SearchOrderConfig parameter is equal to 1.

How to Change the Registry Value

To change the value of SearchOrderConfig parameter, use Set-ItemProperty cmdlet:

Set-ItemProperty -Path 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching' -Name SearchOrderConfig -Value 0

How to Create a New Register Key or Parameter

To add a new registry key, use New-Item command. Create a new key with the name NewKey:

$HKCU_Desktop= 'HKCU:Control PanelDesktop'
New-Item –Path $HKCU_Desktop –Name NewKey

Add a new string parameter with the name SuperParamString and the value file_name.txt for the created key:

New-ItemProperty -Path $HKCU_DesktopNewKey -Name 'SuperParamString' -Value ”file_name.txt” -PropertyType 'String'

Make sure that the new key and parameter have appeared in the registry.

Deleting a Registry Key or Parameter

Remove the parameter SuperParamString created earlier:

$HKCU_Desktop= 'HKCU:Control PanelDesktop'
Remove-ItemProperty –Path $HKCU_DesktopNewKey –Name 'SuperParamString'

Then delete the entire branch:

Remove-Item –Path $HKCU_DesktopNewKey –Recurse

To remove all items in the branch, but not the branch itself, the command looks like this:

Remove-Item –Path $HKCU_DesktopNewKey* –Recurse

How to Rename a Key or a Parameter

To rename the parameter use this command:

Rename-ItemProperty –path ‘HKCU:Control PanelDesktopNewKey’ –name 'SuperParamString' –newname “OldParamString”

In the same way, you can rename the registry key:

Rename-Item -path 'HKCU:Control PanelDesktopNewKey' OldKey

Search the Registry Using PowerShell

PowerShell allows you to search registry. The next script searches the HKCU:Control PanelDesktop the parameters, whose names contain the *dpi* key.

$Path = (Get-ItemProperty ‘HKCU:Control PanelDesktop’)
$Path.PSObject.Properties | ForEach-Object {
If($_.Name -like '*dpi*'){
Write-Host $_.Name ' = ' $_.Value
}
}

Remote Access to the Registry Using PowerShell

PowerShell allows you to access the registry from of a remote computer. You can connect to a remote computer either using WinRM (Invoke-Command or Enter-PSSession):

Invoke-Command –ComputerName srv-fs1 –ScriptBlock { Get-ItemProperty -Path 'HKLM:SystemSetup' -Name WorkingDirectory}

Or using remote registry connection (RemoteRegistry must be enabled)

$Server = 'lon-fs1'
$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $Server)
$RegKey= $Reg.OpenSubKey('SystemSetup')
$RegValue = $RegKey.GetValue('WorkingDirectory')

So, we looked at typical examples of using PowerShell to interract with the Windows registry.

Get Windows 7 Key From Registry

Get Windows Password From Registry