A field technician applied a Group Policy setting to all the workstations in the network. This setting forced the workstations to use a specific SNTP…

Active Directory environments use the Kerberos protocol for authentication, which is highly time-sensitive. For a user to be authenticated, the system clocks of the client workstation and the authenticating domain controller must be synchronized within a specific tolerance, known as the maximum clock skew (by default, 5 minutes). When the Group Policy forced workstations to a new SNTP server, it likely caused their time to drift out of sync with the domain controllers. This time difference exceeds the allowed skew, causing Kerberos ticket validation to fail and preventing users from logging in.

A. An offline SNTP server is a potential cause of the time difference, but the direct reason for authentication failure is the resulting time skew, not the server's status itself.

B. A user changing the time zone on a single machine would be an isolated incident, not a widespread issue affecting all users impacted by a Group Policy.

C. This statement is too general. It describes the outcome but fails to specify the underlying technical cause, which is the clock synchronization failure.

1. Microsoft Corporation. (2021). Kerberos authentication in Windows. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.

Reference Detail: The document states

"This security setting determines the maximum time difference (in minutes) that Kerberos V5 tolerates between the time on the client clock and the time on the domain controller clock... If the difference between a client clock and the domain controller clock is greater than this maximum

any Kerberos V5 authentication request between the client and the domain controller will fail."

2. Microsoft Corporation. (2023). How the Windows Time Service Works. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/how-the-windows-time-service-works.

Reference Detail: Under the "Time Synchronization in an AD DS Forest" section

it explains that in an Active Directory domain

client computers synchronize time with domain controllers. Forcing clients to an external time source can disrupt this hierarchy and cause synchronization issues that break Kerberos authentication.

3. Massachusetts Institute of Technology (MIT). (n.d.). Kerberos V5 Installation Guide: Synchronizing Clocks. MIT Kerberos Documentation. Retrieved from https://web.mit.edu/kerberos/krb5-1.12/doc/admin/install.html#synchronizing-clocks.

Reference Detail: The official documentation for Kerberos

developed at MIT

explicitly states

"In order to work

Kerberos requires the clocks of the hosts to be synchronized... If the clocks are not synchronized

the authenticators will not be valid." This establishes the fundamental link between clock synchronization and authentication success.