| Event Information | According to Microsoft :
Cause :
This event is logged when logging was requested, but the time service encountered an error while trying to write to the log file.
Resolution :
Fix log file issues
The text of the event in Event Viewer should indicate some reason that the Windows Time service was not able to write to the log file. Confirm that you are not viewing the log file in another application, which prevents it from receiving updates from the Windows Time service. Other conditions that might cause the Windows Time service to not be able to write to the log file include the volume where the log file is located not having enough free space or the Windows Time service not having permission to write to the log file.
Before can resolve issues that are related to free space and permissions,must know where the Windows Time service is configured to write its log file.Then ensure that there is enough free space on the volume that contains the log file and verify that the Windows Time service account has access to write logs to that location.
To perform these procedures, you must have membership in Administrators or you must have been delegated the appropriate authority. Perform all steps on the computer that is logging the event to be resolved.
Determine the Windows Time service log file location
To determine the Windows Time service log file location:
Caution : Incorrectly editing the registry might severely damage your system. Before making changes to the registry, back up any valued data.- Open Registry Editor. To open Registry Editor, click Start. In Start Search, type regedit, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
- Navigate to the Config key in the registry by expanding the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time.
- Select the Config key.Should see a string value named FileLogName in the right pane. The path and file name in the filelogname value tell you where the log is configured to be written. If you cannot read the full path and file name, double-click the FileLogName value. The Edit String dialog box appears, displaying the entire path and file name. Note the volume name and location. If you opened the Edit String dialog box, click Cancel to close it.
- Locate the Data column in the FileLogSize value. The number on the right in parentheses indicates how large the log is allowed to become. The value is recorded in bytes; therefore, a decimal value of 10,485,760 is 10 MB.
Determine if enough space is available to write the log file
To determine if enough space is available to write the log file:- Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
- In the command prompt window, type cd \ and then press ENTER. The command prompt is now at the root of the drive. If the command prompt is not at the root of the volume that you saw for the Windows Time service log location, type the volume letter followed by a colon, and then press ENTER.
- Type dir /w and then press ENTER. At the bottom of the output from this command,see how many bytes are free.This number should be larger than the number in the registry for FileLogSize. If it is not,remove unnecessary files from this drive or direct the Windows Time service log file to a new location where sufficient free space is available.
- Close the command prompt.
Determine the Windows Time service logon account name
To determine the Windows Time service logon account name:- Click Start. In Start Search, type services.msc, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. The Services snap-in opens.
- In the list of services in the Name column, double-click Windows Time service. The Windows Time Properties (Local Computer) dialog box opens.
- Click the Log On tab. Record the name of the account that the Windows Time service is configured to use.By default, the account name is Local Service. If the setting is not the default, configure a valid account and password for the Windows Time service to use.
- Click OK, if you made any changes. Otherwise, click Cancel to close the Windows Time Properties (Local Computer) dialog box.
Set the permissions to the Windows Time service log location
To set the permissions to the Windows Time service log location:- Click Start, click Run, and then type the path to the log file to which the Windows Time service is configured to write.Type only the path to the file,not the file name. Click OK. Windows Explorer opens the folder path. If you get an error, check that typed the path correctly If the path does not exist,must return to Registry Editor and change the data path for the FileLogName value to point to a valid location.
- Right-click Windows Time service log file, and then click Properties.The file Properties dialog box opens.
- Click the Security tab.If do not see the account in the list of accounts, click Edit. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
- Click Add. The Select Users, Computers, or Groups dialog box opens.
- In the Enter the object names to select dialog box, type the name of the account that the Windows Time service is configured to use.
- Click Check Names. If you added the account named Local Service, you see a Multiple Account Names Found dialog box.
- Select the LOCAL SERVICE account, and then click OK.
- Click OK to confirm the account in the Select Users, Computers, or Groups dialog box. The dialog box closes.
- With the account name that you entered selected in the Permissions for the log file name dialog box, select the Allow box in the Full Control row of the Permissions for account name section.
- Click OK. The dialog box closes.
Verify :
To verify that the Windows Time service is functioning properly, restart the service, and then check Event Viewer for entries that indicate a successful restart and system time synchronization.
To perform this procedure, must have membership in Administrators or must have been delegated the appropriate authority.
To verify that the Windows Time service is functioning properly:- Click Start. In Start Search, type services.msc, and then click OK. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
- In the list of services, right-click Windows Time, and then click Restart.
When the service restarts successfully, the Service Control Manager reports that the Windows Time service has entered the running state (Event ID 7036) in the Event Viewer. The W32Time source in Event Viewer also reports that the Windows Time service is successfully receiving and synchronizing its clock (Event IDs 37 and 35, respectively). |