Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We have a network where the time on some of the client workstations is inaccurate. There is a problem with NTP on the clients or domain controllers causing the time to not synchronize. We are working on that problem separately.

In the meantime, authentication requests on the domain via NTLM fail after a period of time when the clock drifts away from the domain controller and server's times. What is the threshold of clock accuracy needed for these requests to succeed? Do the clocks have to be accurate to 10 seconds of each other? 30 seconds? One minute?

EDIT: An answer that specifies NTLM does not rely on the correct time is incorrect. According Microsoft KB Article 976918: http://support.microsoft.com/kb/976918

Windows 7 and Windows Server 2008 R2 support Extended Protection for Integrated Authentication which includes support for Channel Binding Token (CBT) by default. [...] You may experience one or more of the following symptoms: [...] NTLM authentication failures when there is a time difference between the client and DC or workgroup server.

share|improve this question

1 Answer 1

As far as I know, timestamps are not used in NTLM at all.

On the other hand, Kerberos (which is the primary authentication protocol in Active Directory), generally requires the clocks to be within a few minutes. Microsoft Windows has 5 minutes as the default MaxClockSkew, as does MIT Kerberos.

share|improve this answer
    
Check the CMOS Battery on the workstations that are lagging behind. More often than not, the batteries are dead. Replacing them will keep their internal clocks more accurately. –  Keltari Mar 1 '12 at 23:49
    
This is not correct. See Microsoft KB article 976918, and the excerpt that I added into the question. support.microsoft.com/kb/976918 –  dotnetengineer Mar 2 '12 at 15:17
    
In our case, we found that AT&T Communication Manager was blocking a machine's attempts to synchronize the time via NTP from the domain controller. After uninstalling AT&T Communication Manager, the time was able to sync and NTLM authentication requests were then allowed. This only affects Windows 7/Server 2008 R2 clients that are accessing Windows 7/Server 2008 R2 servers, or any machine that has the Extended Protection for Authentication hotfix installed and enabled. –  dotnetengineer Mar 10 '12 at 16:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.