| Previous | Next |
| ERROR_MUTUAL_AUTH_FAILED | ERROR_CURRENT_DOMAIN_NOT_ALLOWED |
ERROR_TIME_SKEW
Kerberos rejected authentication because protocol timestamps are outside the permitted clock-skew window
Kerberos uses timestamps to reduce replay risk, so participating systems must agree on time within the configured tolerance. Windows documents a default maximum tolerance of five minutes in domain Kerberos policy. This error is not a time-zone display problem by itself: Kerberos evaluates absolute time relationships between the relevant client, KDC, and target service.
Record time from the client, the KDC that issued or validated the ticket, and the target server at the same moment. Use w32tm diagnostics to determine each machine's source, offset, and domain hierarchy rather than manually setting one clock and declaring the problem fixed. Large VM resume offsets, incorrect PDC time source, disabled Windows Time, or isolated DCs can produce recurring skew. After fixing synchronization, purge/reacquire tickets when necessary so testing does not reuse time-invalid authentication state.
What to inspect
- Compare client, KDC, and target-server offsets at the same timestamp.
- Inspect W32Time source and hierarchy instead of only the displayed local clock.
- Reacquire Kerberos tickets after correcting significant time synchronization problems.
References
- Microsoft: Kerberos clock tolerance
- Microsoft: InitializeSecurityContext Kerberos
- Microsoft: KRB_AP_ERR_MODIFIED
Looking for a different code? Search another status or error code.