Time Synchronization

Active Directory Domain Services uses Kerberos as the primary authentication protocol within the domain, and Kerberos requires all computers to be set to within five minutes of each other. If not, the trust relationship with the machine account is lost.

When a computer first authenticates in a domain, it is issued a ticket-granting ticket (TGT) from a Key Distribution Center (KDC). Then when the computer wants to access any resources, it presents the TGT and requests a ticket for the resource. However, if a computer is more than five minutes out of sync, the KDC will no longer issue tickets and the computer will not be able to access resources.

Computers within a domain are synchronized as shown in Figure below. One domain controller holds the role of a primary domain controller (PDC) emulator. It is commonly configured to synchronize with an external time source.

All domain controllers get their time from the PDC emulator. Then when a domain computer is turned on and authenticates with a domain controller, the client synchronizes its time with the domain controller.

This works great as long as a user doesn't change the time on their computer. If a user does change their time (or date) so that it is more than five minutes off, the computer will effectively be kicked off the domain, at least until it's rebooted and synchronizes with a domain controller.

When the system time is changed and the system is kicked off the network, it's sometimes challenging to identify why. However, this is a great example of how rebooting a system often clears up the problems.