What does NTSTATUS 0xC0000133 (STATUS_TIME_DIFFERENCE_AT_DC) mean?

 
Previous Next
STATUS_LOGON_SERVER_CONFLICT STATUS_SYNCHRONIZATION_REQUIRED

STATUS_TIME_DIFFERENCE_AT_DC

Treat the clock difference as an authentication dependency, not a cosmetic time-setting issue

STATUS_TIME_DIFFERENCE_AT_DC belongs to domain authentication and time hierarchy. Kerberos authenticators and tickets carry time information, and Windows exposes a policy for the maximum clock difference tolerated between a client and the domain controller that performs Kerberos authentication. The PDC emulator also has a special place in the Active Directory time hierarchy.

Measure the offset between the systems that actually participated in the failed authentication. Comparing each clock only with an unrelated public time website can miss the relevant delta. On domain members, first verify the Windows Time source and domain hierarchy; on the forest-root PDC emulator, verify the configured authoritative source and recent W32Time events.

Do not "fix" the failure by permanently widening Kerberos clock-skew tolerance before identifying the bad source. A virtual-machine restore, host-to-guest time injection, broken NTP path, or incorrectly configured PDC source can spread skew to many machines. Record the offset and source chain before forcing synchronization so the original cause remains visible.

What to inspect

  • The client, target service, and KDC/domain controller involved in the failing logon, with their UTC times and measured offsets.
  • The current W32Time source, synchronization state, and event history on the affected member and relevant domain controllers.
  • Whether the PDC emulator or a virtualized domain controller recently moved, resumed from saved state, or changed time sources.

References

Looking for a different code? Search another status or error code.