Windows Server / Active Directory & Group Policy
Check a domain member's time source during Kerberos failures
A member server can resolve domain services yet fail authentication when its clock diverges. Inspect source and synchronization state first.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
w32tm /query /source
w32tm /query /statusRead the result
In an authorized Windows terminal, these report the time service's current source and status. The expected source depends on the member's place in the domain hierarchy.
Resolve and verify
Compare actual UTC time with the approved domain reference and inspect time-service events. Repair the intended hierarchy rather than manually stepping the clock.
Before changing production
Do not point every domain member at an arbitrary public NTP peer or change time during sensitive transactions.