Kerberos Failures Due to Time Drift

Question

Kerberos Failures Due to Time Drift

Hakim Ismail 20

Hi support team

We’ve been running into a recurring technical issue across multiple sites in our AD forest. Several clients are intermittently failing Kerberos authentication, throwing KRB_AP_ERR_SKEW errors. From what we can tell, this points to time synchronization drift between domain controllers and endpoints.

Our environment is fairly large more than 3,000 endpoints spread across different sites so keeping clocks aligned is critical. Right now, the NTP hierarchy may not be properly designed, and we suspect that’s the root cause of these skew errors. For example, when one site’s domain controller drifts even a few minutes out of sync with another, users experience login failures and service disruptions.

We’d like to request Microsoft’s guidance: what is the recommended NTP hierarchy design for a multi‑site forest of this scale, to ensure consistent time sync and prevent Kerberos ticket failures

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi Hakim Ismail,

Kerberos is highly sensitive to time drift, and the KRB_AP_ERR_SKEW errors you’re seeing are almost always tied to inconsistent NTP design across domain controllers and endpoints. In a forest of your scale, the recommended approach is to establish a clear, hierarchical time sync model.

Best practice is to designate the forest root PDC emulator as the authoritative time source for the entire forest. That PDC should synchronize with a reliable external NTP source (such as a set of stratum‑1 or stratum‑2 servers). All other domain controllers in each domain should sync their time from the domain hierarchy, and member servers and clients should sync from their local domain controller. This ensures a consistent cascade of time synchronization without cross‑site drift.

It’s also important to confirm that only one authoritative external source is used, and that you avoid mixing multiple upstream providers across sites. That prevents the “split‑brain” effect where different sites drift apart. For large distributed environments, you may also want to enable monitoring and alerting on time service health, so you can detect skew before it impacts Kerberos.

Jason.