Securing Your NTP Client for Accurate and Reliable Timekeeping

What is Windows NTP Client?

The Network Time Protocol (NTP) was developed in the 1980s to address the growing need for time synchronization between an individual’s computer or device and others on the same network. The Windows NTP (Network Time Protocol) client is a component of the Windows operating system responsible for synchronizing the system’s clock with a time server on the internet or a local network.

Enabling the NTP client allows the device to reach out to the NTP server and send a request for the precise time and correct its time as needed. Windows NTP client periodically contacts a time server to adjust the local system time. This ensures that the computer’s clock stays accurate over time, even if its internal clock drifts slightly. By default, Windows systems are configured to automatically synchronize their time with Microsoft’s time servers, but users can also configure custom time servers if needed.

Why NTP Client is important

A reliable and accurate account of time is important for a number of services and security requirements, including but not limited to distributed applications, authentication services, multi-user databases and logging services. The use of an NTP client (with secure operation) establishes functional accuracy and is a focal point when reviewing security relevant events.

Impact of Enabling Windows NTP Client

Enabling Windows NTP Client enhances system security by ensuring accurate time synchronization, aiding in authentication, compliance, and incident response:

Accuracy and Consistency: Many security protocols and systems rely on accurate timestamps for logging events, analyzing network traffic, and detecting security incidents. If the system time is incorrect, it can lead to issues with logging and analysis, potentially impacting security investigations.

Security: Various security protocols, such as Kerberos authentication, require synchronized time across systems for proper functioning. If not properly synchronized, it can lead to authentication failures and security vulnerabilities.

Compliance: Many compliance standards and regulations such as the Payment Card Industry (PCI) and Data Security Standards (DSS) require accurate time synchronization as part of their security requirements

Vulnerability

Maintaining accurate time is crucial for security, compliance and prevention of certain security threats. Certain security attacks can exploit inconsistencies in system time to intercept or manipulate communication between systems. Such known vulnerabilities are:

CVE-2020-13817 this vulnerability is a denial-of-service (DoS) vulnerability in ntpd before 4.2.8p14 and 4.3.x before 4.3.100. An off-path attacker who can query time from the victim’s ntpd instance can exploit this vulnerability. The NIST CVSS score is 7.4, which is high. This means that this vulnerability can be exploited remotely and cause a complete crash of the system or service.

CVE-2023-26553 this vulnerability discusses an out-of-bounds write vulnerability in the mstolfp function. An attacker could potentially exploit this vulnerability to attack a client ntpq process. The client ntpq process is a program that interacts with the NTP daemon, typically called ntpd, running on a system.

CVE-2020-11868 An unauthenticated attacker can remotely block the synchronization of a targeted system with a time server and has a NIST CVSS risk score of 7.5

How to know if Windows NTP Client is enabled

To establish the recommended configuration, set the following Device Configuration Policy to Enabled:

To access the Device Configuration Policy from the Intune Home page:

1. Click Devices.
2. Click Configuration profiles.
3. Click Create profile.
4. Select the platform (Windows 10 and later).
5. Select the profile (Administrative Templates).
6. Click Create.
7. Enter a Name.
8. Click Next.
9. Configure the following Setting.

Path: Computer Configuration\System\Windows Time Service\Time Providers

Setting Name: Enable Windows NTP Client

Configuration: Enabled

1. Select OK.
2. Continue through the Wizard to complete the creation of the profile (profile assignments, applicability etc.).

Note: More than one configuration setting from each of the Configuration profiles (ex: Administrative Templates, Custom etc.) can be added to each Device Configuration Policy.

Configure Windows NTP client via Group Policy

To configure Windows NTP client setting via Group Policy (GP), follow these steps:

1. Open the Group Policy Editor by pressing Windows+R, typing 'gpedit.msc', and pressing OK.
2. Navigate to:

Computer Configuration > Administrative Templates > System > Windows Time Service > Time Providers

3. In the right pane, double-click the 'Enable Windows NTP Client' policy setting.

4. Choose 'Enabled' and click 'OK'.

Registry path

Default value

Disabled. (The local computer clock does not synchronize time with NTP servers.)

Best Practice for NTP client

By ensuring that the Windows NTP Client is set to enabled and synchronized with reliable time sources, you can reduce the risk of such attacks. Incorrect configuration or inconsistent application of this setting across network devices may lead to security gaps, thereby increasing the overall risk of unauthorized access or data breaches.

Implementing automatic hardening guarantees the consistent enforcement of the policy across all devices, eliminating the risk of users disabling it or configuring insecure limits.