How to Completely Disable ‘Windows Time’ (W32Time) Service via Group Policy in Windows 11

The Windows Time service (W32Time.dll) is a core system component responsible for synchronizing the local workstation’s clock with a designated Network Time Protocol (NTP) server (usually time.windows.com by default). While accurate timekeeping is critical for Kerberos authentication and cryptography, allowing individual workstations to independently manage their time synchronization via the built-in service introduces unpredictability in strict enterprise, military, or zero-trust deployments. In highly secure environments, all endpoints MUST synchronize time strictly via a tightly controlled, air-gapped domain controller hierarchy or a dedicated, hardware-backed precision time appliance (e.g., using PTP or a heavily vetted third-party NTP agent). The native W32Time service, if unmanaged, can fall back to external internet servers or drift, causing catastrophic authentication failures.

This guide explains how to completely disable the ‘Windows Time’ (W32Time) Service via Group Policy in Windows 11, enforcing a strict zero-trust model where the OS is prevented from independently managing its clock.

Disable the Windows Time Service via Group Policy

To enforce a strict block that permanently neutralizes the W32Time daemon globally across the OS, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions. (Warning: Do not perform this action unless you have a dedicated, third-party time synchronization agent ready to take over, or the machine is completely air-gapped and time-independent).

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > System > Windows Time Service

5. In the right-hand pane, locate the policy named Global Configuration Settings.
6. Double-click the policy to open its configuration window.
7. To completely shut down the service’s functionality, we do not just disable the settings; we must ensure the time providers are disabled. Navigate to the Time Providers subfolder:

   Computer Configuration > Administrative Templates > System > Windows Time Service > Time Providers

8. Double-click Enable Windows NTP Client and select Disabled.
9. Double-click Enable Windows NTP Server and select Disabled.
10. (By explicitly disabling both the client and server providers, you instruct the W32Time service that it has no valid operational vectors, effectively neutralizing its ability to poll external NTP sources or serve time to other machines).

Verify the Configuration Lockdown

Group Policy changes affecting core system services require the service to be restarted or the machine to reboot.

Open Command Prompt as Administrator and run gpupdate /force, then restart the computer. To verify the restriction is active, open an elevated Command Prompt and attempt to manually force a time sync using the command w32tm /resync. The system will return an error stating, “The service has not been started” or “The computer did not resync because no time data was available.” Furthermore, navigating to Settings > Time & language > Date & time will show the “Sync now” button greyed out or failing to execute. The Windows 11 workstation is now cryptographically bound to a strict, time-isolated state, ready for external orchestration.