Cyberpediaby Brain
ENDEFR

Secure time synchronization

Why company computers must share the same time, what employees do, and the pitfalls of a misconfigured time server.

In 30 seconds

Where it happens
At sign-in, when accessing an internal service, or when a connection error message appears with no obvious cause.
What happens
Kerberos authentication tolerates a gap of 5 minutes between two clocks by default1.
The reflex
Leave the date and time on automatic setting, and report any unexplained connection or certificate error to the IT team instead of working around it.
If it is already done
If the computer's time was set by hand, switch back to automatic and tell the IT team.

What it is

In a company, computers and servers constantly check one another: who is signing in, to what, and when. Some of these checks rely on the time. If two machines do not agree on the time, some checks fail, and the employee sees it as a refused sign-in or an error they cannot explain.

Time synchronization means setting all clocks to the same reference, at regular intervals and without human intervention. This page explains the principle, what employees can check themselves, and a few configuration errors that mostly concern the IT team.

Straight answers

Why does the time matter for signing in?

The Kerberos protocol, used in corporate Windows networks, uses timestamps to prevent replay attacks, meaning the reuse of an authentication credential by a malicious program or user1. For these timestamps to be of any use, the clock of the computer and that of the domain controller must be as close as possible1. Microsoft writes that the Windows time service "is essential to the successful operation of Kerberos V5 authentication" and therefore to authentication based on Active Directory2.

What gap is tolerated?

A setting called "Maximum tolerance for computer clock synchronization" sets the maximum gap that Kerberos accepts between the client's clock and the domain controller's clock1. Its default value is 5 minutes, and Microsoft advises keeping it1. If the gap stays below this limit, the timestamp is considered authentic1.

What is NTP?

NTP (Network Time Protocol) is the protocol that lets a computer query a time server to correct its clock. The Windows time service uses it to synchronize the clocks of a network2. Windows, MacOS and Linux all offer automatic synchronization through NTP, which generally starts with the system and runs in the background4.

Do I have to set the time myself?

No. NIST, the US body that provides a public time service over the Internet, states that automatic synchronization generally requires no intervention, and that setting the clock by hand is "generally not necessary"4.

What should I do when a connection error has no explanation?

Check that the computer's date and time are on automatic, then write to the IT team describing the error.

1How it works1 min

A computer receives time samples from one or more NTP servers. The Windows time service picks the best sample using the algorithms defined by NTP, then sets the local clock, either by adjusting its rate or by changing it directly if the gap is too large5.

In an Active Directory domain, the chain is hierarchical. Computers that are domain members synchronize with a domain controller by default. The controller acting as PDC emulator at the root of the forest is generally set to an external source25. The most accurate sources are at the top of the chain, and accuracy can drop as one moves away from the reference5.

Microsoft states that with Windows Server 2016 and the Windows 10 Anniversary Update, under reasonable conditions, a domain member can stay within 1 millisecond or better of UTC time2.

Kerberos works with three parties: the client, the target service and a key distribution center (KDC) that both trust3. At sign-in, the client obtains an initial ticket (TGT), then asks the KDC for a ticket for each service it wants to access3.

2What you do1 min
  • Leave the date and time on automatic setting. NIST states that Windows, MacOS and Linux have this option4.
  • On Windows, a right-click on the taskbar clock gives access to the "sync now" button, which contacts a time server and corrects the clock if needed4. On a Mac, the setting is in Applications, System Preferences, Date and Time4.
  • Do not fix a wrong time by typing it in by hand on a company-managed computer: manual setting is generally not necessary4. A clock that drifts anyway is a signal to pass on to the IT team.
  • If a sign-in or access to a service fails for no clear reason, or if a certificate warning appears, do not work around it. Note the message, the time and the service concerned, then report it to the IT team.
3Pitfalls2 min

An unauthenticated time server

Time requests to NIST's public service, in the DAYTIME, TIME and NTP formats, generally do not support authentication4. NIST also offers NTP messages authenticated with a symmetric key, provided by separate servers: authentication guarantees that the message comes from a NIST server and was not modified along the way4.

In an Active Directory forest, Microsoft describes an authentication of NTP packets based on the computer's Kerberos session key. An unsigned or wrongly signed packet is rejected5. However, if a client is manually set to an NTP server outside its domain hierarchy, the packets are not authenticated and therefore not safe, even when forest trust relationships exist5.

A computer outside the domain or rarely connected

Computers that are not joined to a domain, or that synchronize infrequently, are set by default to time.windows.com5. Microsoft states that it is impossible to guarantee time accuracy on machines whose network connection is intermittent or absent5.

Mixed time sources

Google recommends configuring Compute Engine virtual machines with a single NTP server, Google's internal server6. Mixing this service with an external one can cause unpredictable time changes6. External services such as pool.ntp.org often handle the leap second with a jump, and machines may then see repeated timestamps6. To check the configuration on Linux with chrony, the documentation gives the command chronyc sources, which should show a single source6.

The leap second

A leap second is a one-second adjustment of UTC time6. Depending on the system, it is handled by repeating a second or by spreading it over a longer period, and NTP messages do not say which method a server has chosen4. NIST notes that it is then difficult to combine data from different sources around the event4.

Fact sheet

Identifier
CP-492
Wing
3. Protocols and defence
Brain skill
Understanding Cyberspace (understand_cyberspace)
Brain reflex
cr-060
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. Microsoft, “Maximum tolerance for computer clock synchronization”. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj852172(v=ws.11) (accessed 3 November 2026)
  2. Microsoft, “Windows Time Service (W32Time)”. https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-top (accessed 3 November 2026)
  3. Microsoft, “Kerberos authentication overview in Windows Server”. https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview (accessed 3 November 2026)
  4. NIST, “NIST Internet Time Service (ITS)”, 10 February 2010. https://www.nist.gov/pml/time-and-frequency-division/time-distribution/internet-time-service-its (accessed 3 November 2026)
  5. Microsoft, “How the Windows Time Service Works”. https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/how-the-windows-time-service-works (accessed 3 November 2026)
  6. Google, “Configure NTP on a compute instance”. https://docs.cloud.google.com/compute/docs/instances/time-synchronization/configure-ntp (accessed 3 November 2026)

Cite this article

Brain, “Secure time synchronization”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/secure-ntp-time-synchronization/

BibTeX 
@misc{brain_cp492_en_2026,
  author = {Brain},
  title = {Secure time synchronization},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/secure-ntp-time-synchronization/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence