--- id: CP-492 slug: secure-ntp-time-synchronization lang: en title: Secure time synchronization description: Why company computers must share the same time, what employees do, and the pitfalls of a misconfigured time server. canonical_url: https://startbrain.io/cyberpedia/en/articles/secure-ntp-time-synchronization/ markdown_url: https://startbrain.io/cyberpedia/en/articles/secure-ntp-time-synchronization.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Secure time synchronization", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/secure-ntp-time-synchronization/ (CC BY 4.0) wing: 3 theme: understand_cyberspace reflex: cr-060 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/secure-ntp-time-synchronization/ fr: https://startbrain.io/cyberpedia/fr/articles/synchronisation-horaire-ntp-securisee/ de: https://startbrain.io/cyberpedia/de/articles/sichere-zeitsynchronisation-ntp/ es: https://startbrain.io/cyberpedia/es/articles/sincronizacion-horaria-ntp-segura/ sources: - "n": 1 title: Maximum tolerance for computer clock synchronization publisher: Microsoft url: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj852172(v=ws.11) accessed: "2026-11-03" - "n": 2 title: Windows Time Service (W32Time) publisher: Microsoft url: https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-top accessed: "2026-11-03" - "n": 3 title: Kerberos authentication overview in Windows Server publisher: Microsoft url: https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview accessed: "2026-11-03" - "n": 4 title: NIST Internet Time Service (ITS) publisher: NIST url: https://www.nist.gov/pml/time-and-frequency-division/time-distribution/internet-time-service-its published: "2010-02-10" accessed: "2026-11-03" - "n": 5 title: How the Windows Time Service Works publisher: Microsoft url: https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/how-the-windows-time-service-works accessed: "2026-11-03" - "n": 6 title: Configure NTP on a compute instance publisher: Google url: https://docs.cloud.google.com/compute/docs/instances/time-synchronization/configure-ntp accessed: "2026-11-03" --- # Secure time synchronization In a company, computers and servers constantly check one another: who is signing in, to what, and when. Some of these checks rely on the time. If two machines do not agree on the time, some checks fail, and the employee sees it as a refused sign-in or an error they cannot explain. Time synchronization means setting all clocks to the same reference, at regular intervals and without human intervention. This page explains the principle, what employees can check themselves, and a few configuration errors that mostly concern the IT team. ## In 30 seconds - Where it happens: at sign-in, when accessing an internal service, or when a connection error message appears with no obvious cause. - What happens: Kerberos authentication tolerates a gap of 5 minutes between two clocks by default [1]. - The reflex: leave the date and time on automatic setting, and report any unexplained connection or certificate error to the IT team instead of working around it. - If it is already done: if the computer's time was set by hand, switch back to automatic and tell the IT team. ## Straight answers ### Why does the time matter for signing in? The Kerberos protocol, used in corporate Windows networks, uses timestamps to prevent replay attacks, meaning the reuse of an authentication credential by a malicious program or user [1]. For these timestamps to be of any use, the clock of the computer and that of the domain controller must be as close as possible [1]. Microsoft writes that the Windows time service "is essential to the successful operation of Kerberos V5 authentication" and therefore to authentication based on Active Directory [2]. ### What gap is tolerated? A setting called "Maximum tolerance for computer clock synchronization" sets the maximum gap that Kerberos accepts between the client's clock and the domain controller's clock [1]. Its default value is 5 minutes, and Microsoft advises keeping it [1]. If the gap stays below this limit, the timestamp is considered authentic [1]. ### What is NTP? NTP (Network Time Protocol) is the protocol that lets a computer query a time server to correct its clock. The Windows time service uses it to synchronize the clocks of a network [2]. Windows, MacOS and Linux all offer automatic synchronization through NTP, which generally starts with the system and runs in the background [4]. ### Do I have to set the time myself? No. NIST, the US body that provides a public time service over the Internet, states that automatic synchronization generally requires no intervention, and that setting the clock by hand is "generally not necessary" [4]. ### What should I do when a connection error has no explanation? Check that the computer's date and time are on automatic, then write to the IT team describing the error. ## How it works A computer receives time samples from one or more NTP servers. The Windows time service picks the best sample using the algorithms defined by NTP, then sets the local clock, either by adjusting its rate or by changing it directly if the gap is too large [5]. In an Active Directory domain, the chain is hierarchical. Computers that are domain members synchronize with a domain controller by default. The controller acting as PDC emulator at the root of the forest is generally set to an external source [2][5]. The most accurate sources are at the top of the chain, and accuracy can drop as one moves away from the reference [5]. Microsoft states that with Windows Server 2016 and the Windows 10 Anniversary Update, under reasonable conditions, a domain member can stay within 1 millisecond or better of UTC time [2]. Kerberos works with three parties: the client, the target service and a key distribution center (KDC) that both trust [3]. At sign-in, the client obtains an initial ticket (TGT), then asks the KDC for a ticket for each service it wants to access [3]. ## What you do - Leave the date and time on automatic setting. NIST states that Windows, MacOS and Linux have this option [4]. - On Windows, a right-click on the taskbar clock gives access to the "sync now" button, which contacts a time server and corrects the clock if needed [4]. On a Mac, the setting is in Applications, System Preferences, Date and Time [4]. - Do not fix a wrong time by typing it in by hand on a company-managed computer: manual setting is generally not necessary [4]. A clock that drifts anyway is a signal to pass on to the IT team. - If a sign-in or access to a service fails for no clear reason, or if a certificate warning appears, do not work around it. Note the message, the time and the service concerned, then report it to the IT team. ## Pitfalls ### An unauthenticated time server Time requests to NIST's public service, in the DAYTIME, TIME and NTP formats, generally do not support authentication [4]. NIST also offers NTP messages authenticated with a symmetric key, provided by separate servers: authentication guarantees that the message comes from a NIST server and was not modified along the way [4]. In an Active Directory forest, Microsoft describes an authentication of NTP packets based on the computer's Kerberos session key. An unsigned or wrongly signed packet is rejected [5]. However, if a client is manually set to an NTP server outside its domain hierarchy, the packets are not authenticated and therefore not safe, even when forest trust relationships exist [5]. ### A computer outside the domain or rarely connected Computers that are not joined to a domain, or that synchronize infrequently, are set by default to time.windows.com [5]. Microsoft states that it is impossible to guarantee time accuracy on machines whose network connection is intermittent or absent [5]. ### Mixed time sources Google recommends configuring Compute Engine virtual machines with a single NTP server, Google's internal server [6]. Mixing this service with an external one can cause unpredictable time changes [6]. External services such as pool.ntp.org often handle the leap second with a jump, and machines may then see repeated timestamps [6]. To check the configuration on Linux with chrony, the documentation gives the command `chronyc sources`, which should show a single source [6]. ### The leap second A leap second is a one-second adjustment of UTC time [6]. Depending on the system, it is handled by repeating a second or by spreading it over a longer period, and NTP messages do not say which method a server has chosen [4]. NIST notes that it is then difficult to combine data from different sources around the event [4]. ## Sources 1. Microsoft, "Maximum tolerance for computer clock synchronization". https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj852172(v=ws.11) (accessed 3 November 2026) 2. Microsoft, "Windows Time Service (W32Time)". https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-top (accessed 3 November 2026) 3. Microsoft, "Kerberos authentication overview in Windows Server". https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview (accessed 3 November 2026) 4. NIST, "NIST Internet Time Service (ITS)", 10 February 2010. https://www.nist.gov/pml/time-and-frequency-division/time-distribution/internet-time-service-its (accessed 3 November 2026) 5. Microsoft, "How the Windows Time Service Works". https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/how-the-windows-time-service-works (accessed 3 November 2026) 6. Google, "Configure NTP on a compute instance". https://docs.cloud.google.com/compute/docs/instances/time-synchronization/configure-ntp (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/secure-ntp-time-synchronization/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.