Windows Monitor - System Time Check Script

Problem Overview

IT professionals often struggle with inconsistent time zones, missing or incorrect NTP configurations, and system clocks that drift out of sync. These issues can cause authentication failures, scheduling confusion, and compliance risks, making reliable system time crucial in any managed environment.

Description

This script checks the current time zone against the intended target and attempts to apply the correct setting if there is a mismatch. It also verifies that the system clock is synchronized, detects whether an NTP server is properly configured, and logs any failures or successes so you can take timely action. By ensuring accurate system time, this resource helps streamline operations and reduce performance or security bottlenecks tied to incorrect clocks.

Script

1<#
2This resource is provided as a convenience for Level users. We cannot 
3guarantee it will work in all environments. Please test before deploying 
4to your production environment. We welcome contributions to our community 
5library
6
7Level Library
8https://level.io/library/script-windows-monitor-system-time-check
9#>
10
11# Set the target time zone
12$TARGET_TIMEZONE = "{{cf_timezone}}"
13
14# Variables to track failed checks
15$check_count = 0
16$checks_failed = @()
17
18# Get the current time zone
19$current_timezone = (Get-TimeZone).Id
20Write-Output "Current Time Zone: $current_timezone"
21
22# Check if the time zone matches the target
23if ($current_timezone -ne $TARGET_TIMEZONE) {
24    Write-Output "ALERT: Time zone is not $TARGET_TIMEZONE. Attempting to set it..."
25    try {
26        Set-TimeZone -Id $TARGET_TIMEZONE
27        Write-Output "Time zone set to $TARGET_TIMEZONE successfully."
28    } catch {
29        Write-Output "Failed to set time zone to $TARGET_TIMEZONE."
30        $check_count++
31        $checks_failed += "Failed to set time zone to $TARGET_TIMEZONE."
32    }
33}
34
35# Check if the system clock is synchronized
36$clock_sync = w32tm /query /status | Select-String "Stratum"
37if ($clock_sync -match "Stratum:\s+(\d+)" -and [int]$matches[1] -eq 0) {
38    Write-Output "ALERT: System clock is not synchronized."
39    $check_count++
40    $checks_failed += "System clock is not synchronized."
41}
42
43# Check if an NTP server is properly configured
44$ntp_server = w32tm /query /configuration | Select-String "NtpServer" | Select-String -NotMatch "NtpServer: (Local|.*,0x[0-9A-F]+$)"
45if (-not $ntp_server) {
46    Write-Output "ALERT: No NTP server is properly configured."
47    $check_count++
48    $checks_failed += "No NTP server is configured."
49}
50
51# Final check summary
52if ($check_count -gt 0) {
53    Write-Output "ALERT: $check_count checks failed."
54    Write-Output "Checks Failed: $($checks_failed -join ', ')"
55    exit 1
56} else {
57    Write-Output "SUCCESS: All checks passed."
58    exit 0
59}

‍

Use Cases

• Monitoring Windows endpoints that frequently change time zones or have known clock drift issues
• Maintaining compliance in environments where precise time synchronization is essential
• Ensuring critical applications reliant on accurate timestamps run without disruption
• Quickly identifying and correcting missing or misconfigured NTP settings

Recommendations

• Configure a script-based monitor in Level to run this check whenever time consistency issues are suspected
• For scheduled checks, create an automation in Level with a schedule trigger to run this script regularly
• Test in a non-production environment first to confirm no unexpected impacts occur
• Verify that the specified time zone matches your local or organizational requirements
• Use Level’s system-level permissions to minimize the risk of permission-related errors

FAQ

• Can this script change the time zone on domain-joined systems?
  ‍Yes, it attempts to set the time zone if it differs from the target. However, domain policies may override local changes.

• How do I verify the script worked correctly?
  ‍The script outputs success or failure messages. Check the script logs in Level for details about any failed checks.

• What happens if I already have multiple NTP servers configured?
  ‍The script looks for a properly set NTP server entry. Multiple servers generally aren’t an issue as long as at least one is valid.

• Is there a risk of disrupting user sessions when the time zone is changed?
  ‍Typically minimal, but test carefully because any in-session timestamps may be affected.

• Can I customize the NTP server settings?
  ‍Yes, update your system’s w32tm configuration or any relevant GPO settings to specify the preferred servers.