Global Configuration Settings (Windows 11 Group Policy)

What it does

This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs. If this policy setting is enabled, W32time Service on target machines use the settings provided here. Otherwise, the service on target machines use locally configured settings values. For more details on individual parameters, combinations of parameter values as well as definitions of flags, see https://go.microsoft.com/fwlink/?linkid=847809. FrequencyCorrectRate This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause larger corrections; larger values cause smaller corrections. Default: 4 (scalar). HoldPeriod This parameter indicates how many consistent time samples the client computer must receive in a series before subsequent time samples are evaluated as potential spikes. Default: 5 LargePhaseOffset If a time sample differs from the client computer's local clock by more than LargePhaseOffset, the local clock is deemed to have drifted considerably, or in other words, spiked. Default: 50,000,000 100-nanosecond units (ns) or 5 seconds. MaxAllowedPhaseOffset If a response is received that has a time variation that is larger than this parameter value, W32time sets the client computer's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client computer's local clock is corrected gradually. Default: 300 seconds. MaxNegPhaseCorrection If a time sample is received that indicates a time in the past (as compared to the client computer's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. MaxPosPhaseCorrection If a time sample is received that indicates a time in the future (as compared to the client computer's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. PhaseCorrectRate This parameter controls how quickly W32time corrects the client computer's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more quickly; larger values cause the clock to correct more slowly. Default: 7 (scalar). PollAdjustFactor This parameter controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar). SpikeWatchPeriod This parameter specifies the amount of time that samples with time offset larger than LargePhaseOffset are received before these samples are accepted as accurate. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds. UpdateInterval This parameter specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, or 1 second. General parameters: AnnounceFlags This parameter is a bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal EventLogFlags This parameter controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask. LocalClockDispersion This parameter indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds. MaxPollInterval This parameter controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, or 1024 seconds. (Should not be set higher than 15.) MinPollInterval This parameter controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, or 64 seconds. ClockHoldoverPeriod This parameter indicates the maximum number of seconds a system clock can nominally hold its accuracy without synchronizing with a time source. If this period of time passes without W32time obtaining new samples from any of its input providers, W32time initiates a rediscovery of time sources. Default: 7800 seconds. RequireSecureTimeSyncRequests This parameter controls whether or not the DC will respond to time sync requests that use older authentication protocols. If enabled (set to 1), the DC will not respond to requests using such protocols. Default: 0 Boolean. UtilizeSslTimeData This parameter controls whether W32time will use time data computed from SSL traffic on the machine as an additional input for correcting the local clock. Default: 1 (enabled) Boolean ClockAdjustmentAuditLimit This parameter specifies the smallest local clock adjustments that may be logged to the W32time service event log on the target machine. Default: 800 Parts per million (PPM). RODC parameters: ChainEntryTimeout This parameter specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds. ChainMaxEntries This parameter controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries. ChainMaxHostEntries This parameter controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries. ChainDisable This parameter controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean. ChainLoggingRate This parameter controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: Software\Policies\Microsoft\W32Time\Config

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

In Intune

Native Intune setting: Yes — Policy CSP

./Device/Vendor/MSFT/Policy/Config/ADMX_W32Time/W32TIME_POLICY_CONFIGADMX_W32Time on Microsoft LearnADMX-backed: Windows ships this template, so it is set with the template's own values, without an import.Windows builds listed: 10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
FrequencyCorrectRateDefault: 4	Number	`FrequencyCorrectRate`	1 to 4294967295
HoldPeriodDefault: 5	Number	`HoldPeriod`	1 to 4294967295
LargePhaseOffsetDefault: 50000000	Number	`LargePhaseOffset`	0 to 4294967295
MaxAllowedPhaseOffsetDefault: 300	Number	`MaxAllowedPhaseOffset`	0 to 4294967295
MaxNegPhaseCorrectionDefault: 172800	Number	`MaxNegPhaseCorrection`	0 to 4294967295
MaxPosPhaseCorrectionDefault: 172800	Number	`MaxPosPhaseCorrection`	0 to 4294967295
PhaseCorrectRateDefault: 1	Number	`PhaseCorrectRate`	1 to 4294967295
PollAdjustFactorDefault: 5	Number	`PollAdjustFactor`	1 to 4294967295
SpikeWatchPeriodDefault: 900	Number	`SpikeWatchPeriod`	1 to 4294967295
UpdateIntervalDefault: 100	Number	`UpdateInterval`	1 to 4294967295
AnnounceFlagsDefault: 10	Number	`AnnounceFlags`	0 to 16
EventLogFlagsDefault: 2	Number	`EventLogFlags`	0 to 3
LocalClockDispersionDefault: 10	Number	`LocalClockDispersion`	0 to 16
MaxPollIntervalDefault: 10	Number	`MaxPollInterval`	0 to 4294967295
MinPollIntervalDefault: 6	Number	`MinPollInterval`	0 to 15
ClockHoldoverPeriodDefault: 7800	Number	`ClockHoldoverPeriod`	1024 to 260000
RequireSecureTimeSyncRequestsDefault: 0	Number	`RequireSecureTimeSyncRequests`	0 to 1
UtilizeSslTimeDataDefault: 1	Number	`UtilizeSslTimeData`	0 to 1
ClockAdjustmentAuditLimitDefault: 800	Number	`ClockAdjustmentAuditLimit`	128 to 4294967295
ChainEntryTimeoutDefault: 16	Number	`ChainEntryTimeout`	2 to 16
ChainMaxEntriesDefault: 128	Number	`ChainMaxEntries`	128 to 1024
ChainMaxHostEntriesDefault: 4	Number	`ChainMaxHostEntries`	1 to 4
ChainDisableDefault: 0	Number	`ChainDisable`	0 to 1
ChainLoggingRateDefault: 30	Number	`ChainLoggingRate`	0 to 10080

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

State Enabled Disabled Not configured

Options used when Enabled

FrequencyCorrectRate1 to 4294967295

HoldPeriod1 to 4294967295

LargePhaseOffset0 to 4294967295

MaxAllowedPhaseOffset0 to 4294967295

MaxNegPhaseCorrection0 to 4294967295

MaxPosPhaseCorrection0 to 4294967295

PhaseCorrectRate1 to 4294967295

PollAdjustFactor1 to 4294967295

SpikeWatchPeriod1 to 4294967295

UpdateInterval1 to 4294967295

AnnounceFlags0 to 16

EventLogFlags0 to 3

LocalClockDispersion0 to 16

MaxPollInterval0 to 4294967295

MinPollInterval0 to 15

ClockHoldoverPeriod1024 to 260000

RequireSecureTimeSyncRequests0 to 1

UtilizeSslTimeData0 to 1

ClockAdjustmentAuditLimit128 to 4294967295

ChainEntryTimeout2 to 16

ChainMaxEntries128 to 1024

ChainMaxHostEntries1 to 4

ChainDisable0 to 1

ChainLoggingRate0 to 10080

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config]
"AnnounceFlags"=dword:0000000A
"ChainDisable"=dword:00000000
"ChainEntryTimeout"=dword:00000010
"ChainLoggingRate"=dword:0000001E
"ChainMaxEntries"=dword:00000080
"ChainMaxHostEntries"=dword:00000004
"ClockAdjustmentAuditLimit"=dword:00000320
"ClockHoldoverPeriod"=dword:00001E78
"EventLogFlags"=dword:00000002
"FrequencyCorrectRate"=dword:00000004
"HoldPeriod"=dword:00000005
"LargePhaseOffset"=dword:02FAF080
"LocalClockDispersion"=dword:0000000A
"MaxAllowedPhaseOffset"=dword:0000012C
"MaxNegPhaseCorrection"=dword:0002A300
"MaxPollInterval"=dword:0000000A
"MaxPosPhaseCorrection"=dword:0002A300
"MinPollInterval"=dword:00000006
"PhaseCorrectRate"=dword:00000001
"PollAdjustFactor"=dword:00000005
"RequireSecureTimeSyncRequests"=dword:00000000
"SpikeWatchPeriod"=dword:00000384
"UpdateInterval"=dword:00000064
"UtilizeSslTimeData"=dword:00000001

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Global Configuration Settings
# Name: W32TIME_POLICY_CONFIG
# Scope: Machine
# State: Enabled
# Source: W32Time.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'FrequencyCorrectRate' -PropertyType 'DWord' -Value 4

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'HoldPeriod' -PropertyType 'DWord' -Value 5

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'LargePhaseOffset' -PropertyType 'DWord' -Value 50000000

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxAllowedPhaseOffset' -PropertyType 'DWord' -Value 300

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxNegPhaseCorrection' -PropertyType 'DWord' -Value 172800

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxPosPhaseCorrection' -PropertyType 'DWord' -Value 172800

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'PhaseCorrectRate' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'PollAdjustFactor' -PropertyType 'DWord' -Value 5

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'SpikeWatchPeriod' -PropertyType 'DWord' -Value 900

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'UpdateInterval' -PropertyType 'DWord' -Value 100

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'AnnounceFlags' -PropertyType 'DWord' -Value 10

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'EventLogFlags' -PropertyType 'DWord' -Value 2

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'LocalClockDispersion' -PropertyType 'DWord' -Value 10

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxPollInterval' -PropertyType 'DWord' -Value 10

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MinPollInterval' -PropertyType 'DWord' -Value 6

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ClockHoldoverPeriod' -PropertyType 'DWord' -Value 7800

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'RequireSecureTimeSyncRequests' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'UtilizeSslTimeData' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ClockAdjustmentAuditLimit' -PropertyType 'DWord' -Value 800

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainEntryTimeout' -PropertyType 'DWord' -Value 16

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainMaxEntries' -PropertyType 'DWord' -Value 128

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainMaxHostEntries' -PropertyType 'DWord' -Value 4

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainDisable' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainLoggingRate' -PropertyType 'DWord' -Value 30

These deployment candidates come from the ADMX template; they are separate from the native CSP mapping above.

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_W32Time/W32TIME_POLICY_CONFIG

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_W32Time/W32TIME_POLICY_CONFIG</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;
&lt;data id="W32TIME_FrequencyCorrectRate" value="4"/&gt;
&lt;data id="W32TIME_HoldPeriod" value="5"/&gt;
&lt;data id="W32TIME_LargePhaseOffset" value="50000000"/&gt;
&lt;data id="W32TIME_MaxAllowedPhaseOffset" value="300"/&gt;
&lt;data id="W32TIME_MaxNegPhaseCorrection" value="172800"/&gt;
&lt;data id="W32TIME_MaxPosPhaseCorrection" value="172800"/&gt;
&lt;data id="W32TIME_PhaseCorrectRate" value="1"/&gt;
&lt;data id="W32TIME_PollAdjustFactor" value="5"/&gt;
&lt;data id="W32TIME_SpikeWatchPeriod" value="900"/&gt;
&lt;data id="W32TIME_UpdateInterval" value="100"/&gt;
&lt;data id="W32TIME_AnnounceFlags" value="10"/&gt;
&lt;data id="W32TIME_EventLogFlags" value="2"/&gt;
&lt;data id="W32TIME_LocalClockDispersion" value="10"/&gt;
&lt;data id="W32TIME_MaxPollInterval" value="10"/&gt;
&lt;data id="W32TIME_MinPollInterval" value="6"/&gt;
&lt;data id="W32TIME_ClockHoldoverPeriod" value="7800"/&gt;
&lt;data id="W32TIME_RequireSecureTimeSyncRequests" value="0"/&gt;
&lt;data id="W32TIME_UtilizeSslTimeData" value="1"/&gt;
&lt;data id="W32TIME_ClockAdjustmentAuditLimit" value="800"/&gt;
&lt;data id="W32TIME_ChainEntryTimeout" value="16"/&gt;
&lt;data id="W32TIME_ChainMaxEntries" value="128"/&gt;
&lt;data id="W32TIME_ChainMaxHostEntries" value="4"/&gt;
&lt;data id="W32TIME_ChainDisable" value="0"/&gt;
&lt;data id="W32TIME_ChainLoggingRate" value="30"/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Global Configuration Settings
# Name: W32TIME_POLICY_CONFIG
# Scope: Machine
# State: Enabled
# Source: W32Time.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'FrequencyCorrectRate' -Kind 'DWord' -Expected 4
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\FrequencyCorrectRate') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'HoldPeriod' -Kind 'DWord' -Expected 5
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\HoldPeriod') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'LargePhaseOffset' -Kind 'DWord' -Expected 50000000
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\LargePhaseOffset') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxAllowedPhaseOffset' -Kind 'DWord' -Expected 300
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\MaxAllowedPhaseOffset') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxNegPhaseCorrection' -Kind 'DWord' -Expected 172800
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\MaxNegPhaseCorrection') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxPosPhaseCorrection' -Kind 'DWord' -Expected 172800
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\MaxPosPhaseCorrection') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'PhaseCorrectRate' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\PhaseCorrectRate') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'PollAdjustFactor' -Kind 'DWord' -Expected 5
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\PollAdjustFactor') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'SpikeWatchPeriod' -Kind 'DWord' -Expected 900
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\SpikeWatchPeriod') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'UpdateInterval' -Kind 'DWord' -Expected 100
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\UpdateInterval') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'AnnounceFlags' -Kind 'DWord' -Expected 10
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\AnnounceFlags') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'EventLogFlags' -Kind 'DWord' -Expected 2
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\EventLogFlags') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'LocalClockDispersion' -Kind 'DWord' -Expected 10
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\LocalClockDispersion') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxPollInterval' -Kind 'DWord' -Expected 10
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\MaxPollInterval') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MinPollInterval' -Kind 'DWord' -Expected 6
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\MinPollInterval') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ClockHoldoverPeriod' -Kind 'DWord' -Expected 7800
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\ClockHoldoverPeriod') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'RequireSecureTimeSyncRequests' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\RequireSecureTimeSyncRequests') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'UtilizeSslTimeData' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\UtilizeSslTimeData') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ClockAdjustmentAuditLimit' -Kind 'DWord' -Expected 800
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\ClockAdjustmentAuditLimit') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainEntryTimeout' -Kind 'DWord' -Expected 16
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\ChainEntryTimeout') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainMaxEntries' -Kind 'DWord' -Expected 128
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\ChainMaxEntries') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainMaxHostEntries' -Kind 'DWord' -Expected 4
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\ChainMaxHostEntries') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainDisable' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\ChainDisable') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainLoggingRate' -Kind 'DWord' -Expected 30
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config\ChainLoggingRate') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Global Configuration Settings
# Name: W32TIME_POLICY_CONFIG
# Scope: Machine
# State: Enabled
# Source: W32Time.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'FrequencyCorrectRate' -PropertyType 'DWord' -Value 4

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'HoldPeriod' -PropertyType 'DWord' -Value 5

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'LargePhaseOffset' -PropertyType 'DWord' -Value 50000000

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxAllowedPhaseOffset' -PropertyType 'DWord' -Value 300

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxNegPhaseCorrection' -PropertyType 'DWord' -Value 172800

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxPosPhaseCorrection' -PropertyType 'DWord' -Value 172800

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'PhaseCorrectRate' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'PollAdjustFactor' -PropertyType 'DWord' -Value 5

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'SpikeWatchPeriod' -PropertyType 'DWord' -Value 900

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'UpdateInterval' -PropertyType 'DWord' -Value 100

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'AnnounceFlags' -PropertyType 'DWord' -Value 10

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'EventLogFlags' -PropertyType 'DWord' -Value 2

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'LocalClockDispersion' -PropertyType 'DWord' -Value 10

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MaxPollInterval' -PropertyType 'DWord' -Value 10

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'MinPollInterval' -PropertyType 'DWord' -Value 6

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ClockHoldoverPeriod' -PropertyType 'DWord' -Value 7800

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'RequireSecureTimeSyncRequests' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'UtilizeSslTimeData' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ClockAdjustmentAuditLimit' -PropertyType 'DWord' -Value 800

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainEntryTimeout' -PropertyType 'DWord' -Value 16

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainMaxEntries' -PropertyType 'DWord' -Value 128

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainMaxHostEntries' -PropertyType 'DWord' -Value 4

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainDisable' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\W32Time\Config' -Name 'ChainLoggingRate' -PropertyType 'DWord' -Value 30

History 5 retained releases

22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

4 later releases left it unchanged.

Template

Internal name: W32TIME_POLICY_CONFIG
Namespace: Microsoft.Policies.WindowsTimeService
Template file: W32Time.admx
Release: Windows 11 25H2 · 1.0 · file set de4e49983ebd651f…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.W32TIME_POLICY_CONFIG)" explainText="$(string.W32TIME_CONFIG_EXPLAIN)" key="Software\Policies\Microsoft\W32Time\Config" name="W32TIME_POLICY_CONFIG" presentation="$(presentation.W32TIME_POLICY_CONFIG)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.WindowsTimeService:W32TIME_ROOT" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_WindowsXP" />
      <elements>
        <decimal id="W32TIME_FrequencyCorrectRate" minValue="1" valueName="FrequencyCorrectRate" />
        <decimal id="W32TIME_HoldPeriod" minValue="1" valueName="HoldPeriod" />
        <decimal id="W32TIME_LargePhaseOffset" maxValue="4294967295" valueName="LargePhaseOffset" />
        <decimal id="W32TIME_MaxAllowedPhaseOffset" valueName="MaxAllowedPhaseOffset" />
        <decimal id="W32TIME_MaxNegPhaseCorrection" maxValue="4294967295" valueName="MaxNegPhaseCorrection" />
        <decimal id="W32TIME_MaxPosPhaseCorrection" maxValue="4294967295" valueName="MaxPosPhaseCorrection" />
        <decimal id="W32TIME_PhaseCorrectRate" minValue="1" valueName="PhaseCorrectRate" />
        <decimal id="W32TIME_PollAdjustFactor" minValue="1" valueName="PollAdjustFactor" />
        <decimal id="W32TIME_SpikeWatchPeriod" minValue="1" valueName="SpikeWatchPeriod" />
        <decimal id="W32TIME_UpdateInterval" maxValue="4294967295" minValue="1" valueName="UpdateInterval" />
        <decimal id="W32TIME_AnnounceFlags" maxValue="16" valueName="AnnounceFlags" />
        <decimal id="W32TIME_EventLogFlags" maxValue="3" valueName="EventLogFlags" />
        <decimal id="W32TIME_LocalClockDispersion" maxValue="16" valueName="LocalClockDispersion" />
        <decimal id="W32TIME_MaxPollInterval" valueName="MaxPollInterval" />
        <decimal id="W32TIME_MinPollInterval" maxValue="15" valueName="MinPollInterval" />
        <decimal id="W32TIME_ClockHoldoverPeriod" maxValue="260000" minValue="1024" valueName="ClockHoldoverPeriod" />
        <decimal id="W32TIME_RequireSecureTimeSyncRequests" maxValue="1" minValue="0" valueName="RequireSecureTimeSyncRequests" />
        <decimal id="W32TIME_UtilizeSslTimeData" maxValue="1" minValue="0" valueName="UtilizeSslTimeData" />
        <decimal id="W32TIME_ClockAdjustmentAuditLimit" minValue="128" valueName="ClockAdjustmentAuditLimit" />
        <decimal id="W32TIME_ChainEntryTimeout" maxValue="16" minValue="2" valueName="ChainEntryTimeout" />
        <decimal id="W32TIME_ChainMaxEntries" maxValue="1024" minValue="128" valueName="ChainMaxEntries" />
        <decimal id="W32TIME_ChainMaxHostEntries" maxValue="4" minValue="1" valueName="ChainMaxHostEntries" />
        <decimal id="W32TIME_ChainDisable" maxValue="1" minValue="0" valueName="ChainDisable" />
        <decimal id="W32TIME_ChainLoggingRate" maxValue="10080" minValue="0" valueName="ChainLoggingRate" />
      </elements>
    </policy>

Editor controls

<presentation id="W32TIME_POLICY_CONFIG" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <text>Clock Discipline Parameters</text>
        <decimalTextBox defaultValue="4" refId="W32TIME_FrequencyCorrectRate">FrequencyCorrectRate</decimalTextBox>
        <decimalTextBox defaultValue="5" refId="W32TIME_HoldPeriod">HoldPeriod</decimalTextBox>
        <decimalTextBox defaultValue="50000000" refId="W32TIME_LargePhaseOffset">LargePhaseOffset</decimalTextBox>
        <decimalTextBox defaultValue="300" refId="W32TIME_MaxAllowedPhaseOffset">MaxAllowedPhaseOffset</decimalTextBox>
        <decimalTextBox defaultValue="172800" refId="W32TIME_MaxNegPhaseCorrection">MaxNegPhaseCorrection</decimalTextBox>
        <decimalTextBox defaultValue="172800" refId="W32TIME_MaxPosPhaseCorrection">MaxPosPhaseCorrection</decimalTextBox>
        <decimalTextBox defaultValue="1" refId="W32TIME_PhaseCorrectRate">PhaseCorrectRate</decimalTextBox>
        <decimalTextBox defaultValue="5" refId="W32TIME_PollAdjustFactor">PollAdjustFactor</decimalTextBox>
        <decimalTextBox defaultValue="900" refId="W32TIME_SpikeWatchPeriod">SpikeWatchPeriod</decimalTextBox>
        <decimalTextBox defaultValue="100" refId="W32TIME_UpdateInterval">UpdateInterval</decimalTextBox>
        <text>General Parameters</text>
        <decimalTextBox defaultValue="10" refId="W32TIME_AnnounceFlags">AnnounceFlags</decimalTextBox>
        <decimalTextBox defaultValue="2" refId="W32TIME_EventLogFlags">EventLogFlags</decimalTextBox>
        <decimalTextBox defaultValue="10" refId="W32TIME_LocalClockDispersion">LocalClockDispersion</decimalTextBox>
        <decimalTextBox defaultValue="10" refId="W32TIME_MaxPollInterval">MaxPollInterval</decimalTextBox>
        <decimalTextBox defaultValue="6" refId="W32TIME_MinPollInterval">MinPollInterval</decimalTextBox>
        <decimalTextBox defaultValue="7800" refId="W32TIME_ClockHoldoverPeriod">ClockHoldoverPeriod</decimalTextBox>
        <decimalTextBox defaultValue="0" refId="W32TIME_RequireSecureTimeSyncRequests">RequireSecureTimeSyncRequests</decimalTextBox>
        <decimalTextBox defaultValue="1" refId="W32TIME_UtilizeSslTimeData">UtilizeSslTimeData</decimalTextBox>
        <decimalTextBox defaultValue="800" refId="W32TIME_ClockAdjustmentAuditLimit">ClockAdjustmentAuditLimit</decimalTextBox>
        <decimalTextBox defaultValue="16" refId="W32TIME_ChainEntryTimeout">ChainEntryTimeout</decimalTextBox>
        <decimalTextBox defaultValue="128" refId="W32TIME_ChainMaxEntries">ChainMaxEntries</decimalTextBox>
        <decimalTextBox defaultValue="4" refId="W32TIME_ChainMaxHostEntries">ChainMaxHostEntries</decimalTextBox>
        <decimalTextBox defaultValue="0" refId="W32TIME_ChainDisable">ChainDisable</decimalTextBox>
        <decimalTextBox defaultValue="30" refId="W32TIME_ChainLoggingRate">ChainLoggingRate</decimalTextBox>
      </presentation>

Supported platforms and category

Microsoft.Policies.Products:product:MicrosoftWindows
sha256:4b3cb6917b5e5b7cd142c0157f10882786b3e9ee67c29fd7b8f4c6cb2eec5fe7
Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:definition:SUPPORTED_WindowsXP
<definition displayName="$(string.SUPPORTED_WindowsXP)" name="SUPPORTED_WindowsXP" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="2" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
Microsoft.Policies.WindowsTimeService:category:W32TIME_ROOT
<category displayName="$(string.W32TIME_ROOT)" name="W32TIME_ROOT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:System" />
    </category>
Microsoft.Policies.Products:product:MicrosoftWindows
<product displayName="$(string.MicrosoftWindows)" name="MicrosoftWindows" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <majorVersion displayName="$(string.MicrosoftWindows2000)" name="MicrosoftWindows2000" versionIndex="1">
          <minorVersion displayName="$(string.MicrosoftWindows2000_RTM)" name="MicrosoftWindows2000_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP1)" name="MicrosoftWindows2000_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP2)" name="MicrosoftWindows2000_SP2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP3)" name="MicrosoftWindows2000_SP3" versionIndex="3" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP4)" name="MicrosoftWindows2000_SP4" versionIndex="4" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsXP)" name="MicrosoftWindowsXP" versionIndex="2">
          <minorVersion displayName="$(string.MicrosoftWindowsXP_RTM)" name="MicrosoftWindowsXP_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP1)" name="MicrosoftWindowsXP_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP2)" name="MicrosoftWindowsXP_SP2" versionIndex="2" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer2003)" name="MicrosoftWindowsServer2003" versionIndex="3">
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_RTM)" name="MicrosoftWindowsServer2003_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP1)" name="MicrosoftWindowsServer2003_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_R2)" name="MicrosoftWindowsServer2003_R2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP2)" name="MicrosoftWindowsServer2003_SP2" versionIndex="3" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsVista)" name="MicrosoftWindowsVista" versionIndex="4">
          <minorVersion displayName="$(string.MicrosoftWindowsVista_RTM)" name="MicrosoftWindowsVista_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsVista_SP1)" name="MicrosoftWindowsVista_SP1" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.WindowsServer2008)" name="WindowsServer2008" versionIndex="5">
          <minorVersion displayName="$(string.WindowsServer2008_RTM)" name="WindowsServer2008_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.WindowsServer2008_R2)" name="WindowsServer2008_R2" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows7)" name="MicrosoftWindows7" versionIndex="6">
          <minorVersion displayName="$(string.MicrosoftWindows7_RTM)" name="MicrosoftWindows7_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer8)" name="MicrosoftWindowsServer8" versionIndex="7">
           <minorVersion displayName="$(string.MicrosoftWindowsServer8_RTM)" name="MicrosoftWindowsServer8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows8)" name="MicrosoftWindows8" versionIndex="8">
          <minorVersion displayName="$(string.MicrosoftWindows8_RTM)" name="MicrosoftWindows8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_RT)" name="MicrosoftWindows_RT" versionIndex="9">
          <minorVersion displayName="$(string.MicrosoftWindows_RT_RTM)" name="MicrosoftWindows_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_6_3)" name="MicrosoftWindowsServer_6_3" versionIndex="10">
           <minorVersion displayName="$(string.MicrosoftWindowsServer_6_3_RTM)" name="MicrosoftWindowsServer_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3)" name="MicrosoftWindows_6_3" versionIndex="11">
          <minorVersion displayName="$(string.MicrosoftWindows_6_3_RTM)" name="MicrosoftWindows_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3_RT)" name="MicrosoftWindows_6_3_RT" versionIndex="12">
            <minorVersion displayName="$(string.MicrosoftWindows_6_3_RT_RTM)" name="MicrosoftWindows_6_3_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_10_0)" name="MicrosoftWindowsServer_10_0" versionIndex="13">
            <minorVersion displayName="$(string.MicrosoftWindowsServer_10_0_RTM)" name="MicrosoftWindowsServer_10_0_RTM" versionIndex="0" />
          </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0)" name="MicrosoftWindows_10_0" versionIndex="14">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RTM)" name="MicrosoftWindows_10_0_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0_RT)" name="MicrosoftWindows_10_0_RT" versionIndex="15">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RT_RTM)" name="MicrosoftWindows_10_0_RT_RTM" versionIndex="0" />
        </majorVersion>
      </product>
<strings><string id="Microsoft.Policies.Products:MicrosoftWindows">Windows operating system</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000">Windows 2000 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_RTM">Windows 2000</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP1">Windows 2000 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP2">Windows 2000 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP3">Windows 2000 Service Pack 3</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP4">Windows 2000 Service Pack 4</string><string id="Microsoft.Policies.Products:MicrosoftWindows7">Windows 7 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows7_RTM">Windows 7</string><string id="Microsoft.Policies.Products:MicrosoftWindows8">Windows 8 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows8_RTM">Windows 8</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003">Windows Server 2003 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_R2">Windows Server 2003 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_RTM">Windows Server 2003</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP1">Windows Server 2003 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP2">Windows Server 2003 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8">Windows Server 2012 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8_RTM">Windows Server 2012</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0">Windows Server 2016 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0_RTM">Windows Server 2016</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3">Windows Server 2012 R2 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3_RTM">Windows Server 2012 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista">Windows Vista operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_RTM">Windows Vista</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_SP1">Windows Vista Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP">Windows XP operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_RTM">Windows XP</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP1">Windows XP Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP2">Windows XP Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0">Windows 10 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT">Windows 10 RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RTM">Windows 10</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT_RTM">Windows 10 RT</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3">Windows 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT">Windows RT 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RTM">Windows 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT_RTM">Windows RT 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT">Windows RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT_RTM">Windows RT</string><string id="Microsoft.Policies.Products:WindowsServer2008">Windows Server 2008 operating systems</string><string id="Microsoft.Policies.Products:WindowsServer2008_R2">Windows Server 2008 R2</string><string id="Microsoft.Policies.Products:WindowsServer2008_RTM">Windows Server 2008</string></strings>
Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:System">System</string><string id="Microsoft.Policies.Windows:System_Help">Allows configuration of various system component settings.</string></strings>
Microsoft.Policies.Windows:definition:SUPPORTED_WindowsXP
<definition displayName="$(string.SUPPORTED_WindowsXP)" name="SUPPORTED_WindowsXP" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="2" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.Windows:SUPPORTED_WindowsXP">At least Windows Server 2003 operating systems or Windows XP Professional</string></strings>
Microsoft.Policies.WindowsTimeService:category:W32TIME_ROOT
<category displayName="$(string.W32TIME_ROOT)" name="W32TIME_ROOT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:System" />
    </category>
<strings><string id="Microsoft.Policies.WindowsTimeService:W32TIME_ROOT">Windows Time Service</string></strings>