Windows XP NTP Timestamp

Does anyone know where the timestamp for when the NTP time was last updated? In Windows XP, if you right click the clock -> Date/Time Settings -> Internet Time, you see a Last Synced Time and Date. Where is that pulled from?

I can't find anything in the registry (some intervals and frequencies, etc). But none that look like a timestamp.

When I boot into the disk as a VM, I have to Activate windows, thus requiring an internet connection. But, with the connection available, Windows updates the time before I can access it.

Any help or insight would be helpful.

To start youshould use a WPA crack to get around the activation.

Also, you can get around the activation using a sly workaround. Tutorial here

http//www.thetomorrowtimes.com/2006/12/how-to-login-to-expired-windows.html

This might grant you enough access to check the value you're looking for.

Does anyone know where the timestamp for when the NTP time was last updated? In Windows XP, if you right click the clock -> Date/Time Settings -> Internet Time, you see a Last Synced Time and Date.

Not sure about that – what clock is that? If I open Control Panel | Date and Time | Internet Time, I see a 'Next synchronization' time, not a Last Synched.

That appears most likely to be stored as the last write time in one of the W32Time keys and some time period, but I haven't tested it thoroughly. The 'Next synch time' is updated on a manual time synch, and those appear to be the only registry key(s) in which values are set on an update.

@hmorgan The network error resolved itself and I was able to activate it.

@athulin I checked, all my W32Time keys post-date the last sync time.

Is it getting the last time from the Time Service Event log?

H

I am not familiar with that event log.

Based on entries in W32Time, if I recall correctly, it is set to log on source change and reachability changes.

I am not familiar with that event log.

Based on entries in W32Time, if I recall correctly, it is set to log on source change and reachability changes.

My apologies that is the event name in Vista, but in XP it logs a system event for me when the time is synchronised.

H

Which it isn't set to log time syncs. Plus, it makes more sense that it would be in a constant location, rather than having to scan through an event file to find the last sync time.

Thus far, I haven't found that location.

Also, you can get around the activation using a sly workaround. Tutorial here

http//www.thetomorrowtimes.com/2006/12/how-to-login-to-expired-windows.html

This might grant you enough access to check the value you're looking for.

Thank you, this actually worked quite well. I got the data I wanted.