I was getting Event ID 27 on a server. The error read:
Time Provider NtpClient: The response received from domain controller <host dns name> is missing the signature. The response may have been tampered with and will be ignored.
This sounds likes a scary message, with warnings that the response has been tampered with, but like many messages it just means that there was some glitch and the servers aren’t syncing correctly anymore. I found the solution at EventID.net, and it’s pretty simple. Just open a command prompt and run this command:
w32tm /resync /rediscover
After that the time synced correctly. Others have said that unregistering and reregistering the time service works as well.
Time syncing isn’t a vitally important issue, but computers do slip out of sync sometimes, and especially in a domain there can be consequences for getting too far ahead or behind. Good to make sure that the time service is always working correctly.