Time synchronization across domain hierarchy
Overview
Kerberos tolerates ~5 minutes skew; beyond that, auth storms look like “random lockouts.” Virtual DCs are prone without correct hypervisor integration.
Standard
- Only PDC Emulator syncs upstream to reliable NTP stratum sources; other DCs sync to it.
- Hyper-V: disable time sync for DC VMs except brief first-boot scenarios—let domain hierarchy rule.
Tools
w32tm /stripchart /computer:... from clients; Event ID time-service warnings.
Troubleshoot
FW blocks UDP 123 outbound from DC; third-party agents fighting Windows Time; dual-boot rogue hardware clock.
Monitoring
SCOM/RMM synthetic Kerberos authentication smoke test or login script timestamp drift checks on samples.
Cloud tie-ins
Azure AD DS and hybrid still need on-prem sanity for legacy apps—do not assume cloud fixes forest quirks.
Documentation
Diagram NTP path to internet; note if GPS hardware used in DC closet for stratum-1 diehards.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...