Event ID - 141

Event Id141
SourceMicrosoft-Windows-Time-Service
DescriptionThe time service has stopped advertising as a time source because there are no providers running.
Event InformationAccording to Microsoft :
Cause :
This event is logged when the time service has stopped advertising as a time source because there are no providers running.
Resolution :
Ensure that there is at least one time provider configured
To resolve this issue:
  • Ensure there is at least one time provider configured on the computer that is generating Event 141, and restart the Windows Time service.
  • If at least one time provider is configured, enable Windows Time logging and consult the log.
  • If there is not at least one time provider configured, unregister and then register the Windows Time service.
To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.
Ensure that one time provider is configured
To ensure that at least one time provider is configured:
  1. Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. Restart the Windows Time service. Type net stop w32time & net start w32time, and then press ENTER.
  3. Review the configuration of the Windows Time service. At the command prompt, type w32tm /query /configuration /verbose, and then press ENTER.
  4. In the [Time Providers] section of the command output, ensure that there is at least one entry showing Enabled set to 1. If there is a time provider that is enabled, enable Windows Time service logging as described in the following section. If there is not a time provider enabled, unregister and then register the Windows Time service as described later in this document.
Enable Windows Time service logging
To enable Windows Time service logging and review the log file:
  1. Open a command prompt as an administrator.
  2. Create a folder to receive the Windows Time service log file. At the command prompt, type md c:\W32Time, and then press ENTER. The command creates a directory named W32Time on the C: drive.
  3. To enable Windows Time service debug logging, at the command prompt, type w32tm /debug /enable /file:c:\W32Time\w32time.log /size:10000000 /entries:0-116, and then press ENTER.
  4. Type w32tm /config /update, and then press ENTER.
  5. Open the w32time.log file in Notepad. In the command prompt window, type start notepad c:\w32time\w32time.log.
  6. Scroll to the end of the log to see if you can identify any errors that indicate that Windows Time service values from the registry are null. You can reset the Windows Time service values in the registry by unregistering and then registering the service.
Unregister and register the Windows Time Service
To unregister and register the W32time service:
  1. To stop the Windows Time service, at the command prompt, running as an administrator, type net stop w32time, and then press ENTER.
  2. To unregister the Windows Time service dynamic-link library (DLL), at the command prompt, type w32tm /unregister, and then press ENTER.
  3. To register the Windows Time service DLL, at the command prompt, type w32time /register, and then press ENTER.
  4. To start the Windows Time service, at the command prompt, type net start w32time, and then press ENTER.
Post-troubleshooting cleanup
You can disable Windows Time debug logging by running the command W32tm /debug /disable. You can also remove the c:\w32time folder and w32time.log file when troubleshooting is complete.
To remove the folder and log file:
  1. To remove the log file, you must first stop the Windows Time service. To stop the Windows Time service, at the command prompt, type net stop w32time, and then press ENTER.
  2. To remove the c:\w32time folder, at the command prompt, type rd c:\w32time /s /q, and then press ENTER.
  3. Start the Windows Time service again. To start the Windows Time service again, at the command prompt, type net start w32time, and then press ENTER.
Verify :
When the Windows Time service is advertising time as a time source, Event ID 139, "The time service has started advertising as a time source," is logged in Event Viewer.
Reference LinksEvent ID 141 from Source Microsoft-Windows-Time-Service

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.