Time Providers
A DLL the Windows Time service loads as a time provider when it starts.
Use it to find a DLL loaded into the Windows Time service at every start, beside the built-in NTP providers.
- SYSTEM
- Persistence
What It Is
The Windows Time service keeps the computer clock accurate, and it uses time providers to do this. An input provider gets the time from hardware or the network, and an output provider gives the time to other computers on the network. Each provider has a key under W32Time\TimeProviders in HKLM SYSTEM with DllName, Enabled and InputProvider values. The time provider manager starts each enabled provider at system startup.
What It Proves
A DllName under a TimeProviders subkey, with Enabled set to 1, is loaded by the Windows Time service, which runs under a service host. It persists across reboots in a service context.
What It Does Not Prove
NtpClient and NtpServer ship with Windows, and Hyper-V or VMware add genuine providers on virtual machines, so judge any other by its DLL. The provider loads only while the time service runs.
Where It Lives
Time Providers lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The NtpClient provider loads the genuine w32time |
| NtpClient is enabled, so the time service loads it while it runs. Enabled with a System32 DllName is the normal state for this provider. |
| VMICTimeProvider, the Hyper-V provider Windows ships, loads a System32 DLL as expected. An unknown provider or a DLL elsewhere is the one to resolve. |
How to Read It
List the subkeys under TimeProviders. NtpClient and NtpServer are standard, and VMICTimeProvider is normal under Hyper-V. Read DllName and Enabled in each. An unknown provider or a non System32 DLL is suspect. Resolve the DllName and check it against the known time components.
- When Windows Writes It
- When a provider is registered or enabled, usually with admin rights.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Microsoft does not say which keys Defender records, so confirm it records this one first. A hit shows a provider registered, not that the time service loaded it.
// A DllName registered under TimeProvidersDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Time Providers shows.
- ServicesShows whether the Windows Time service is set to run, which is when the provider loads.
- Time Service Loads a DLL, Sysmon Event 7Not in the RegistryShows the time service loading the provider DLL.
Sources
The facts on this page come from these public pages, which say more on each point.