Windows sucks at Automatic Time Zones.

# The Problem:

We have a customer with an office located in Brisbane, Australia, who has a pretty standard setup - Windows 11 Laptops, Cisco Networking, ZScaler for Internet Security, Ethernet to every desk, a common IT SOE.

However, a couple of weeks ago we started seeing hints of an issue with some of the laptops, users were reporting that their device timezone kept changing to Adelaide (which is 2 hours behind), and then back to Brisbane randomly.

This seemed like just a temporary thing at first, but it started getting worse, it went from 1 to 2 laptops, to 5, to 10, to the whole office, it was obvious something had gone wrong, so I started looking into it.

[Example of what we were seeing, but pretend it says Adelaide and not Beijing.](https://imgur.com/yFbfvYD)

# How are Timezones automatically updated on Windows?

You ask a Desktop Support guy this question, and they'd probably say "oh it's from AD/GPO", or "it's from the NTP server", or "it's from the switch/DHCP server", but is that actually true? - **Nope** \- Turns out [Windows Exclusively uses location for automatic Timezones.](https://support.microsoft.com/en-au/windows/windows-location-service-and-privacy-3a8eee0a-5b0b-dc07-eede-2a5ca1c49088#:~:text=Location%20services%20also%20enables%20Windows%20features%20like%20automatic%20time%20zone)

Specifically, [the below are used](https://learn.microsoft.com/en-us/uwp/api/Windows.Devices.Geolocation?redirectedfrom=MSDN&view=winrt-22000#accuracy-expectations):

* GPS : accurate within *approximately* 10 meters. You won't find many (if any) corporate laptops with GPS built-in, so I haven’t spent much time poking at this path.
* Wi-Fi : accurate within *approximately* 30 meters - 500 meters. This method works by scanning the surrounding Network at all times when Wi-Fi is turned on (even if you aren't actually connected to Wi-Fi), Windows also doesn't care if you are using Ethernet, it will still scan. There is **ZERO** public documentation of the “algorithm” or “scoring logic” that Windows uses for this, we just know that it looks at nearby BSSID's (usually the same as the MAC address, though Microsoft only ever calls them MAC's) then checks the [**Microsoft geolocation database**](https://account.microsoft.com/privacy/location-services-opt-out) which we aren't allowed to even see - [at least not anymore.](https://elie.net/blog/privacy/using-the-microsoft-geolocalization-api-to-retrace-where-a-windows-laptop-has-been)
* Cell towers : accurate within approximately 300 meters - 3,000 meters. This is a good one, it might not be the most precise, but it's highly likely to be accurate, of course this is only available on devices with a cellular modem, however it [apparently](https://android.stackexchange.com/questions/140349/can-you-use-cell-tower-triangulation-without-a-sim-card) [does not require an active service](https://android.stackexchange.com/questions/140349/can-you-use-cell-tower-triangulation-without-a-sim-card#:~:text=SIM%20cards%20are,to%20cellular%20networks) or even a SIM card, it uses the Microsoft Geolocation Database similar to the Wi-Fi method.
* IP address: accurate within approximately 1,000 meters - 5,000 meters. As many IT folks know, IP‑based location services aren’t very precise and can be wrong at times - IP addresses change often, and IP‑to‑location databases quickly become outdated. Microsoft maintains its own database for this, but in my experience, Windows only falls back to it when WI‑Fi based location is low-confidence/accuracy.

>The system automatically selects the most appropriate location source based on availability, accuracy requirements, and power consumption considerations. - Microsoft

# How Timezones are NOT updated on Windows:

* NTP - So the thing about Network Time Protocol, is it has zero concept of timezones, it [uses UTC time, always,](https://www.meinbergglobal.com/english/faq/faq_32.htm) it leaves timezone settings up to the OS of the client. Interestingly, Windows actually uses UTC behind the scenes for everything and just

applies your timezone offset to stuff that is user facing, who knew.
* Active Directory - AD actually has a protocol for syncing time from DC's that is built off of (but also distinct to) NTP, it's barely documented, but [it's called MS-SNTP](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sntp/8106cb73-ab3a-4542-8bc8-784dd32031cc). MS-SNTP is enabled by default in AD for all clients, *except* if you are running under a hypervisor (then Windows shrugs and uses the HV), but both will **never** set timezones, only time.

[Windows client syncing from a Domain Controller.](https://imgur.com/E645jM5)

* DHCP - If you are well versed in DHCP options, you may know about option 101, which [allows you to configure a timezone to be available from DHCP](https://www.krisolaf.net/2024/11/dhcp-options-42-100-101-for-setting.html). However, rather annoyingly, Windows won't ever request this option from the DHCP server, not on its own. [There's a good doc here about getting Windows to pull this from DHCP and actually use it](https://oofhours.com/2019/12/20/configuring-time-zones-part-2/), but by default the data never goes to the Windows client, so... nope.
* Network switches/firewalls - Fairly obvious, these don't play any part in Timezones being set, if a switch clock is set to Antarctica it doesn't matter (looking at you network engineers). Similarly to DHCP, the 802.11v protocol does have some capability to advertise timezones (from WAP's in this case), but this is rarely implemented in networking hardware, [OpenWRT appears to support it,](https://forum.openwrt.org/uploads/default/original/3X/9/a/9a9f32b40978a4eba54962477529ed1360dc39b4.png) but Windows does not use it anyway.
* Group Policies/Intune - Timezones are rarely set by Group Policy, it would only make sense if you have a single office location and/or had a robust policy that applied based on user/device location. We haven't seen any customers with a setup like this, so in 90% of cases I would immediately rule out any policies as being the source of your device Timezones. That being said, [it can be done](https://www.georgealmeida.com/2013/11/set-time-zone-via-group-policy-object/).

# So what's causing our problem?

This is the tricky part, figuring out what location source Windows is getting the wrong information from.

Let's start with logs, in addition to the notification the user gets, the following event is logged (event ID 1). As you can see, the change is coming from svchost.exe, so this is almost certainly the "Auto Time Zone Updater" service completing its regular check-in.

[Event ID 1, the system time zone has changed.](https://imgur.com/uyFxlAO)

Alright, so we know when changes are happening, but we don't know why. Let's check for more logs, right? - Nope. This is it.

Windows keeps its location tracking methods close to the chest. It won’t tell you which source it used, and it offers no real diagnostics. So when something goes sideways, we’re essentially on our own.

# Screw it, I'll make my own troubleshooting tool.

I wasn't going to sit in front of a laptop all day, wait for the device timezone/location to be wrong and then quickly troubleshoot for the few minutes I had each time, there had to be a better way.

So I spun up PowerShell ISE and wrote [a noscript to monitor the issue](https://github.com/CForChrisProooo/Windows-Auto-Timezone-Troubleshooter) and collect data for troubleshooting. This is what is does:

[My Timezone logging noscript](https://imgur.com/b2VTBNY)

It’s fairly barebones, it uses GeoCoordinateWatcher to pull coordinates, looks them up against OpenStreetMap, and simultaneously scans nearby access points with netsh to capture BSSIDs. It grabs this data every 15 seconds. It’s a bit of a patchwork tool, and there’s plenty of room for refinement, but it collected exactly what I needed.

So I found a few affected users, set it to run quietly in the background, and logged about an hour’s worth of data.

Before I wrote this noscript, I had a hunch that the issue was somehow ZScaler related, since they don't have any Brisbane

datacentres (at least with our contract right now) and our egress IP through ZIA appeared in Sydney. We raised a ticket with them early on, (because it couldn't hurt) and 2 days later got a response from them.

>We have confirmed that this issue is **not related to Zscaler**, as Zscaler does not set or modify user timezones.

>we recommend checking with your internal IT team, specifically focusing on your **Windows/Active Directory (AD) settings**, as these are the most likely sources of the timezone changes.

It seems that they didn't really understand the issue, which was a common problem when trying to get any engineering/vendor help on this. If our Timezone was changing to Sydney instead of Adelaide, we would have pushed them further as this would be directly caused by ZIA.

Anyway, from my noscript it was pretty clear that the public IP address was not changing at all, which ruled out ZScaler, and based on the accuracy field, it aligned perfectly with the Wi-Fi scanning accuracy expected in metres.

So if we disable Wi-Fi it should stop scanning, and we can see if the issue goes away? Yep, I turned off WLAN on the affected devices and none of them changed their location from Brisbane, perfect.

So this means that Microsoft's Wi-Fi location database is wrong for this location, but if that's the case it should be affecting the business next door too, right?

So I spoke to the IT team from the business next door, and confirmed that they have the exact same issue, with Adelaide as well, and they have a completely separate network to us, wild.

# Now, how do we fix this?

Well, for most customers, it'd be pretty simple, just [disable automatic Timezones on Windows](https://www.elevenforum.com/t/turn-on-or-off-set-time-zone-automatically-in-windows-11.1345/), you could push this via Intune or GPO pretty easily, it's well documented.

For our customer, though, this wasn't a valid option, for these reasons:

* Users travel a lot as part of their roles, and the customer would like Timezones to be automatically updated for them.
* Users are not comfortable managing the system Timezone themselves.
* Service Desk don't have the capacity to be fielding calls for incorrect system times.
* The customer would like the core issue to be resolved rather than using a band-aid solution (fair enough).

# Let's get Microsoft to fix the Geolocation Database.

This is the next logical step, log a support ticket with Microsoft, tell them the problem, give them any data they need, and they should be able to fix it just fine, [people seemed to have luck with this](https://www.reddit.com/r/sysadmin/comments/1jtnrog/comment/nh8l4s0/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button), though apparently it's quite a long and painful process.

So we logged an MS ticket, SEV B (as we've since had a second location affected), and we'll see where it goes.

>Thank you. Your request was successfully submitted to Microsoft Support.

*I'll update the post once we hear back from Microsoft.*

# What else can we do?

Well, there's a few things you can try.

* If you have an Android device, you can [apparently](https://www.reddit.com/r/sysadmin/comments/1mje84j/comment/n7b36n0/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button) run [this app](https://play.google.com/store/apps/details?id=com.here.radiomapper) and walk around your building for 10 minutes, a poster claimed that this resolved the geolocation database issue for Windows about 2 weeks later.
* You could [set up windows to use a different geolocation database from the Microsoft one](https://github.com/catacraciun/windows-location-timezone), this wasn't feasible for us as it's a bit too hacky, and we'd end up in a 6 week long conversation about which database to use.
* You could swap your entire laptop fleet to models that include Cellular radios and/or GPS (good luck).
* You can [request to exclude the nearby WAP's BSSID's from the Microsoft geolocation

database](https://account.microsoft.com/privacy/location-services-opt-out), which I'm not sure is even legal if you don't own all the nearby hardware. Microsoft may completely ignore your request ["if it seems problematic"](https://account.microsoft.com/privacy/location-services-opt-out#:~:text=If%20a%20request%20seems%20problematic%2C), and apparently, [this also isn't a permanent fix.](https://www.reddit.com/r/sysadmin/comments/1jjif2b/comment/mjo2dxm/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button)
* If you have patience, you could wait for the issue to resolve itself. No, seriously, [the database gets updated by Windows devices all the time as they scan the area](https://support.microsoft.com/en-au/windows/windows-location-service-and-privacy-3a8eee0a-5b0b-dc07-eede-2a5ca1c49088?utm_source=chatgpt.com#:~:text=If%20location%20services,of%20the%20provider.), so eventually it might just be fixed. Logically, if you have a Windows device with cellular and/or GPS in the area, the location accuracy should also improve, and faster.
* If your users *only* travel between different company offices, you could [configure Timezones via DHCP and force Windows to use them](https://oofhours.com/2019/12/20/configuring-time-zones-part-2/), but this would only work on *your* Networks and would need manual intervention from users/IT anywhere else.
* If users workflow allows, you could disable Wi-Fi entirely, to force Windows to rely purely on IP based location, if you use a proxy/internet security service like ZScaler though you'll need to make sure the egress IP is in the desired Timezone.
* You can always build your own geolocation database, perhaps make a policy/noscript that has a list of known IP addresses, SSID's, whatever you like and force timezones from that, however this is only possible if you know every location that a user might need to work from.
* The last option is to just deal with the issue, if it's not that impactful to your environment then you can choose to ignore it.

# And that's it.

As of writing this, our problem is ongoing, we've passed the issue on to Microsoft and once we hear back I'll update this post. Our customer isn't particularly interested in any of the available workarounds, so that leaves us standing around, for now.

Hope this helped!

Cheers,

https://redd.it/1pcv5ot
@r_systemadmin

Every time I open Azure I swear something has moved

I logged into Azure this morning and found a setting in a place I’m pretty sure it didn’t exist last week.



Some days whole menus shift.

Some days a toggle appears out of nowhere.

Some days something I use daily is suddenly three clicks deeper.



I don’t know if Microsoft keeps quietly rearranging things or if Azure is just slowly reorganizing itself like a haunted house.



Does everyone else run into this or is it just my brain melting..

https://redd.it/1pcz542
@r_systemadmin

Requests

How do you guys mentally manage all the requests you get?

I’m saying, even if you have a ticketing system, there are so many requests from these users and a lot of times I think about them outside of work when I don’t want to.

I need to start telling myself a lot of people at the company make a lot more money than I do, so work should stay at work. It is tomorrow’s problem.

https://redd.it/1pd2ful
@r_systemadmin

Hey SHI could you NOT send renewal notices that look like Knowb4 tests?

Like seriously, how hard is it to send a link to a web page that has all the renewals listed. An Excel file with a list sent as an attachment is not gonna cut it in this day an age.

https://redd.it/1pd3nep
@r_systemadmin

We work in an industry with more buzzwords than people. Hyper Zero Trust, UltraSASE, AI-XDR, AI sec Posture, AI AI AI AI …& more AI ..it’s getting insane.

Every vendor is trying to invent the next big term just to sound revolutionary.
Half the time it’s the same product with a longer name, a new acronym, and a marketing team that got too much budget.

What’s the most ridiculous buzzword you’ve seen lately?

https://redd.it/1pd5cbs
@r_systemadmin

Just got dumped with the job of getting our environment documentation under control and wow, it’s way worse than I thought.

We’ve got on prem, cloud, random mystery VMs no one will admit to owning, and basically zero up to date diagrams or any clue about what talks to what. I need a tool that can actually auto discover servers, apps, and dependencies, spit out something that looks like a real living map or CMDB, and stay current without me spending the rest of my life in Visio. Agentless or low effort is a huge plus because I’m not looking to babysit another tool.

Right now I’m looking at ServiceNow Discovery and Service Mapping, Faddom, and Dynatrace, but I’d love to hear what’s actually worked for people or any horror stories from trying to clean up this kind of documentation disaster.

https://redd.it/1pd3wx4
@r_systemadmin

Users asking for admin access

“Would you please give me admin access?”

For what reason?

“Because I want to have control over my PC. There’s no reason for me to use an admin username and password just to complete my tasks”

she can perform all her tasks without needing admin rights and she has all the tools she needs

Why do users think they can get admin rights or credentials? How do I even begin to convince someone like this the dangers of what they are asking. And I’m sure she will escalate this to the CEO.

Sigh.


https://redd.it/1pd9jrj
@r_systemadmin

Didn't Think It Would Happen

Didn't think this would happen to me, but I was fired yesterday due to 'Lack of Performance'


My boss was terminated 2 weeks ago by a "Shadow IT" person that I helped train and then she turned around and terminated me. Every reasoning they provided I was able to counter, but it didn't matter. It was already done.


Haven't ever been in this position before, but is it normal to feel so calm about it? I would have imagined I would be a sobbing mess, but maybe I feel a sense of relief.

https://redd.it/1pdb0us
@r_systemadmin

AT&T Mobile Hotspot (bait and switch?) Rant

I work for a public library and we recently demo'd mobile hotspots from AT&T. The demo unit worked fantastic. I drove around the county that our library services and tested it in various locations. Got a good signal and was streaming 4k video from youtube to my phone with no issues everywhere.

Gave my boss the go ahead to order a batch. We loan these to the public. Got them all configured in a week, during which time I had no issues with connectivity. Sent them to our cataloguing department and they did their thing, which took about 2 weeks due to their backlog of books to catalog.

But now, on their first loan periods to patrons, ALL of them are being throttled. And not just for people taking them out in the boonies. Nope, they are getting throttled in town too, where there is supposed to be a great signal. They're clearly being downgraded to 4G LTE signal and it is not loading images or videos. I can browse reddit or look at emails, but no images or videos will load. I also checked usage - 2GB or less of 50GB limit on all devices, so it's not like anyone is hitting the data limit.

I spoke to our rep and he's clueless. Playing dumb. Clearly something changed, but he claims there are no issues on their end.

All these wasted hours going back and forth with the Sales rep, configuring the devices for public use, cataloging them... and they may as well be paperweights now.

I can't help but feel like they put us on one network for the first few weeks to give us great service, then silently downgraded us after a few weeks. We're going to have to cancel. Hopefully we're month to month. What a waste of time and money.

https://redd.it/1pd7n9q
@r_systemadmin

So long Crucial... thanks for the fishes

https://investors.micron.com/news-releases/news-release-details/micron-announces-exit-crucial-consumer-business

via

https://www.reddit.com/r/pcmasterrace/comments/1pd9o76/crucial\_is\_gone/

https://redd.it/1pde08y
@r_systemadmin

your funniest mistakes

So I recently found that messed up my servers firewall rules slightly. I put the rate limit on new connection inadvertently also on outgoing connections.

Yep, I rate limited my outbound traffic and then was flummoxed by spurious DNS and HTTP requests failing.

Misery loves company so what's your latest "put head in paper bag" error?

https://redd.it/1pd74zt
@r_systemadmin

Are all large corporations a mess like where I work, Mastercard?

So about five years ago the company I was working at was as acquired by Mastercard. Then right when they started migrating last year I was offered a new position at the corporate office that after much discussion with my wife I accepted(discussed as in we had to move across the state).

Let me tell you, this has been an eye opener. We have so much management and so many levels of management it’s nearly impossible to get teams to agree to anything so every team is off doing their own thing that’s often either duplicate work or incompatible other systems (without hacking together a bunch of noscripts). There’s absolutely no ownership, it’s like everyone wants someone else to own the systems and they just want to be told what to do. And software development, it’s like our plan is write code then figure out how to manage it or actually sell it to customers. And the H1B hires, there are entire floors of H1B people, and many of them have so much attitude or trying to argue or avoiding responsibility.

I’ve read articles of large multinational corporations and the dumb shit they do but figured people spiced up the story for attention. Now I’m feeling is it really this bad at all of them.

https://redd.it/1pdlv9w
@r_systemadmin

HUMOR -- I play games to relax.. but this...

Somebody had to do it....

An IT/network infra game ......

I play games to relax... Not to bring work home!!

https://github.com/pshenok/server-survival


https://redd.it/1pdligm
@r_systemadmin

Automating Windows post-installs with a simple winget-based noscript

I’ve been standardizing my own Windows setups for a while, and ended up turning that process into a small open-source tool.
It uses winget + a config file to automate app installs, basic settings, and the usual “first 30 minutes” after imaging a machine.

Nothing fancy - just predictable, reproducible, and easy to adapt for personal or team use.
If anyone has ideas on making it more robust (or cleaner), I'm all ears.

Repo: https://github.com/kaic/win-post-install

Site: https://kaic.me/win-post-install/

https://redd.it/1pdpodg
@r_systemadmin

CVE-2025-55182 - React exploit - brown alert time?

Just reading up on this.... and starting to sweat about the vast quantity of react and react-based frameworks that are impacted from what appears to potentially be an *extremely* simple to achieve RCE... (sent request with some code in it, code runs, the end)


Anyone else sweating? I'm just trying to reverse engineer which customer products/tools/web servers might be impacted and the fastest way to find out/mitigate... Been playing with the React developer tools now but struggling with version profiling the servers.


More info here - CVE Record: CVE-2025-55182


Happy Thursday!



https://redd.it/1pdr09b
@r_systemadmin

Help needed: How do you debug super minimal containers?

We just shifted our apps to min container images, NO bash, NO extra, locked down tight to cut vuln. It’s definitely a big win for security, but devs and ops are lost when something BREAKS.

Zero shell or debug tools inside the container means every fix needs spinning up temp debug pods… really slowing us down!!

Is there any better approach to debug, or should we go back to normal container images since we prioritize speed?

https://redd.it/1pdt1sd
@r_systemadmin

In place upgrade domain controller oh my

Does anyone have anything good to say about going from server 2016 to server 2022 but a domain controller.

Ever boss I had says it’s going to tombstone our whole ad if we do….



https://redd.it/1pdudol
@r_systemadmin

Thickheaded Thursday - December 04, 2025

Howdy, /r/sysadmin!

It's that time of the week, Thickheaded Thursday! This is a safe (mostly) judgement-free environment for all of your questions and stories, no matter how silly you think they are. Anybody can answer questions! My name is AutoModerator and I've taken over responsibility for posting these weekly threads so you don't have to worry about anything except your comments!

https://redd.it/1pdw6w2
@r_systemadmin