Fix Kerberos Authentication Failures Caused by Windows Time Drift

Before you begin

Applicable to supported Windows Server/client environments where the named role or feature is installed. Run read-only checks first from an elevated PowerShell or Command Prompt as appropriate. Replace example hostnames, domain names, addresses, ports and paths with values from the affected environment. Record the exact error, timestamp, OS build and scope of impact.

Production safety: obtain change approval and a verified backup before modifying AD DS, DNS, DHCP, firewall, IIS, storage or Hyper-V configuration. Ensure console/out-of-band access before network or remote-access changes.

Symptoms and likely root cause

Domain logon, service tickets or replication fail intermittently with clock-skew errors after VM restore, outage or manual time change.

Incorrect time source at PDC Emulator, UDP 123 blocked, wrong peer or domain members bypassing the domain time hierarchy.

Diagnostic commands

w32tm /query /status
w32tm /query /source
w32tm /query /configuration
w32tm /monitor
netdom query fsmo
Get-Service W32Time

Run the commands in order and save the complete output. The commands above are intended to establish the failing layer before a configuration change is attempted.

How to interpret the results

Members normally follow domain hierarchy (NT5DS). Identify forest-root PDC Emulator and confirm its approved upstream source. UDP 123 is NTP; Test-NetConnection TCP 123 is not a valid NTP test. Use packet capture or NTP tooling to confirm UDP request/response.

Practical correction

Correct the upstream time source on the authoritative PDC tier using approved peers and change control. Keep other DCs/members following domain hierarchy unless design says otherwise. Then run w32tm /resync /rediscover and verify source/status.

Make one change at a time. Re-run the failed diagnostic after each change so the cause-and-effect relationship is clear.

Fallback and recovery

Record prior time configuration. If peer is unreachable, restore approved previous peer and monitor. Check hypervisor time integration if VM clock jumps. Do not configure every workstation/DC to public NTP independently.

Verification checklist

Success: w32tm reports the intended source and recent sync, Kerberos logon/service ticket works and replication stabilises.

• Repeat the original failing operation from the affected client/user or service.
• Test from a second approved endpoint or subnet where relevant.
• Review the relevant event log/IIS log after the fix.
• Record the change, actual result and any remaining limitation.

Frequently asked question

Should I set public NTP on every PC? No. Domain members should normally follow the AD time hierarchy.

Official technical reference

Microsoft Learn — error message run w32tm resync no time data available

Use the official documentation for exact version support, prerequisites and any procedure that differs between Windows Server releases.

Technician field note

This runbook describes a controlled diagnostic path; it is not a universal guarantee that every environment has the same cause. If evidence does not match the expected result, stop and investigate rather than applying unrelated fixes. Do not mark the incident resolved until the original symptom is verified as cleared.