| Event Id | 27 |
| Source | w32time |
| Description | Time Provider NtpClient: The response received from domain controller %1 is missing the signature. The response may have been tampered with and will be ignored. |
| Event Information | According to Microsoft: Cause : Your computer should be a member of a domain, and any responses from the domain controller should be signed (authenticated) by the domain controller. This event can indicate a security situation or that your computer is part of a domain and your account was deleted. The cause might be one of the following: 1.A domain controller has been configured as a manual time source. 2.The computer is synchronizing with both a manual time source and a domain time source (type=AllSync) where one or more domain controllers in the domain is configured as the manual time source. Resolution : Do one or all of the following: Verify with an Administrator that this computer account is valid in Active Directory. Verify that no domain controllers are present in the manual time source list. Configure an alternative manual time source. If your computer is part of a domain, then it should get its time source from the domain controller. The configuration can be modified by using the w32tm command line tool and manipulating the syncfromflags option. |
| Reference Links | Event ID 27 from Source w32time |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.