--- title: "Fix Kerberos Clock Skew Logon Failures Using w32tm" description: "Fix Kerberos clock skew logon failures by checking w32tm sources, pointing the PDC emulator at NTP, and resyncing drifted clients." canonical: "https://adamtheautomator.com/fix-kerberos-clock-skew-w32tm/" --- # Fix Kerberos Clock Skew Logon Failures Using w32tm > Fix Kerberos clock skew logon failures by checking w32tm sources, pointing the PDC emulator at NTP, and resyncing drifted clients. Source: https://adamtheautomator.com/fix-kerberos-clock-skew-w32tm/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Fix Kerberos Clock Skew Logon Failures Using w32tm](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b817aab5dca59f1ca0e14/38378bffb6e067df12a1bd90a3921833213a6e328f7d3baabd1fae698d38ddfd.jpg) # Fix Kerberos Clock Skew Logon Failures Using w32tm [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)22 October 20263 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[Windows](/tag/windows/)[PowerShell](/tag/powershell/) Table of Contents * [Why Five Minutes of Drift Breaks Logons](#why-five-minutes-of-drift-breaks-logons) * [Check Each Machine’s Time Source with w32tm](#check-each-machines-time-source-with-w32tm) * [Read One Machine](#read-one-machine) * [Sweep the Domain](#sweep-the-domain) * [Find the PDC Emulator](#find-the-pdc-emulator) * [Point the PDC Emulator at NTP](#point-the-pdc-emulator-at-ntp) * [Resync the Clients That Drifted](#resync-the-clients-that-drifted) * [Verify the Repair](#verify-the-repair) * [Fix It in This Order Next Time](#fix-it-in-this-order-next-time) Come look at the timestamps on a batch of failed Kerberos logons. Each failure is Kerberos clock skew. The workstation and domain controller disagree by more than the five minutes Kerberos tolerates. Follow that gap up the domain’s time hierarchy, one `w32tm` command at a time. The trail ends at the server that sets the clock for every computer in the forest. ## Why Five Minutes of Drift Breaks Logons Kerberos stamps its tickets with the time. Microsoft’s [Kerberos clock tolerance policy](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization) defaults to 5 minutes. Past that limit, Kerberos requests can fail. The domain controller can record event 4771 with failure code [0x25, “Clock skew too great”](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771). Microsoft’s [authoritative time article](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/configure-authoritative-time-server) describes the hierarchy: “In this hierarchy, the PDC operations master at the root of the forest becomes authoritative for the organization.” The PDC emulator is the domain controller with the [primary domain controller role](https://adamtheautomator.com/fsmo-roles/). Time flows from it to the other domain controllers, then to every member server and workstation, as the diagram below shows. ![AD time hierarchy](https://adamtheautomator.com/wp-content/uploads/publisher/7b8d79ab04e69e98b18b487b0b383d7d72a7bb0c6092caf71bae0da2970527cc.png) ## Check Each Machine’s Time Source with w32tm Open PowerShell as Administrator on a workstation whose logons fail. Remote queries also need Domain Admins membership, per the [w32tm command reference](https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings). ### Read One Machine Run both commands on the failing workstation, with one of your domain controllers in place of DC01: ```powershell w32tm /query /source w32tm /stripchart /computer:DC01 /samples:3 /dataonly ``` On a domain member, the source should be a domain controller’s name. If it reads Local CMOS Clock, the machine found no upstream source and trusts its own hardware clock. The stripchart samples how far this clock sits from that domain controller’s. ### Sweep the Domain Next, check whether the domain controllers drift too. ```powershell w32tm /monitor ``` `w32tm /monitor` reports each domain controller’s offset from the PDC emulator in your default domain. Compare them with the workstation, as the diagram below shows: * Domain controllers near zero, workstation off: reset that member to the domain hierarchy. * Any domain controller off: start at the PDC emulator. ![Time sync decision flow](https://adamtheautomator.com/wp-content/uploads/publisher/b441481456310879ebdb56370e094d0c47a5d79980531cdfaeaad3b4da9c2187.png) ## Find the PDC Emulator Domain-wide repairs start with the server that holds the role. The [Get-ADDomain cmdlet](https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addomain) returns it as the PDCEmulator property and needs the Active Directory PowerShell module. Query the forest root domain, because child-domain PDC emulators follow the domain hierarchy: ```powershell (Get-ADDomain -Identity (Get-ADForest).RootDomain).PDCEmulator ``` ## Point the PDC Emulator at NTP Run these commands on that server. The `,0x8` after each peer makes the Windows Time service (W32Time) poll in client mode, one of the [NtpServer flags Microsoft documents](https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings). Skip the `,0x1` flag from the [registry walkthrough](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/configure-authoritative-time-server). That flag switches polling to a fixed SpecialPollInterval. The [spike-state article](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/specialpollinterval-polling-interval-time-service-not-correct) shows such a client never correcting once the offset passes the 5-second default for LargePhaseOffset. * * * _**Warning: The next command rewrites the Windows Time configuration on this server. First check for a Group Policy that configures Windows NTP Client, because W32Time then ignores the NtpServer registry value. Run ******`w32tm /query /configuration`****** to see where each setting comes from.**_ * * * ```powershell w32tm /config /manualpeerlist:"0.pool.ntp.org,0x8 1.pool.ntp.org,0x8 2.pool.ntp.org,0x8" /syncfromflags:manual /reliable:yes /update ``` `/syncfromflags:manual` selects your peer list and `/reliable:yes` marks the server as a reliable time source. After `/update` tells W32Time to apply the change, restart the service and rediscover sources: ```powershell net stop w32time net start w32time w32tm /resync /rediscover ``` ## Resync the Clients That Drifted Some stray members once sat outside the domain, where someone pointed them at a specific time server. Put them back on the hierarchy: ```powershell w32tm /config /syncfromflags:domhier /update net stop w32time net start w32time w32tm /resync /rediscover ``` W32Time sets the clock outright on any domain member whose offset exceeds the 300-second [default MaxAllowedPhaseOffset](https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings), so expect one visible jump. ## Verify the Repair Run these on the PDC emulator, then rerun the `/query` and `/monitor` lines on a member: ```powershell w32tm /query /source w32tm /monitor w32tm /stripchart /computer:0.pool.ntp.org /samples:5 /dataonly ``` * The source should name a configured peer on the PDC emulator and a domain controller on members. * The monitor output should show a near-zero offset for every domain controller. * The stripchart samples your offset against the peer five times. Errors there point at UDP port 123 between the PDC emulator and the internet. * * * _**Pro Tip: Add /computer:name to /query or /resync to check or nudge a remote machine without logging on to it.**_ * * * Domain controllers default to 172,800 seconds, or 48 hours, for MaxPosPhaseCorrection and MaxNegPhaseCorrection. If the stripchart still shows your PDC emulator further off than that, W32Time has logged an event and left the clock alone. Move the clock closer by hand, then follow Microsoft’s guidance for a [large time offset](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/configure-w32ime-against-huge-time-offset). ## Fix It in This Order Next Time Repair from the top down: 1. Run `w32tm /query /source` on the PDC emulator, and if it reads Local CMOS Clock, rebuild its NTP peers. 2. Run `w32tm /monitor` to find the domain controllers that still disagree, then resync each with `w32tm /resync /rediscover`. 3. Reset stray members with `/syncfromflags:domhier`, then resync them. But if you resync a member before fixing the PDC emulator, it drifts back to whatever its domain controller reports. Microsoft also recommends a [hardware time source](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/configure-authoritative-time-server) for the PDC emulator, because internet NTP isn’t authenticated. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Ffix-kerberos-clock-skew-w32tm%2F&text=Fix%20Kerberos%20Clock%20Skew%20Logon%20Failures%20Using%20w32tm)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Ffix-kerberos-clock-skew-w32tm%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Ffix-kerberos-clock-skew-w32tm%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81798ecbd4ce17ad4211/3af27311d4ef00790ee9d17c229fa6097b6ee8b242b0a21e0b024c9807f61639.jpg) ### [Who Really Restarted Windows Server? Event ID 1074 and 6008](/event-id-1074-windows-server-restart/) Use one Get-WinEvent filter to find which account, process, and reason restarted a Windows Server, from Event ID 1074 and 6008 logs. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81e69730da4c690758c2/4afeea42b7f854d23285b281664351779f042510f1e3a1d766d02cfa39b711a8.jpg) ### [Find and Disable Every Inactive AD Computer with PowerShell](/find-inactive-computers-active-directory/) Find inactive computer accounts in Active Directory with Search-ADAccount, then disable and quarantine them with PowerShell in steps you can undo. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3ec5d9c85b2b815cacb1ece7c7ca9758/edff0257593a62603f4fae3b57f62db3fbe832f8af0bcc7638ea7ebd721274c7.jpg) ### [Set Up NPS RADIUS on Windows Server Without Silent Rejects](/nps-radius-windows-server-setup/) Install Windows Server NPS as a RADIUS server for Wi-Fi and VPN, build PEAP and EAP-TLS policies, and decode event 6273 before users complain. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)