A Windows 11 domain member refuses to take its time from a Samba AD DC running chrony. Plain NTP works, the configuration is fine, yet the DC never answers. The cause: above functional level 2012, Windows uses the MS-SNTP extended authenticator, which neither chrony nor Samba support. I patched both, and after one more trap in the byte order, Windows now accepts the signed replies.
Category: Microsoft
Windows clocks drift, jump or silently stop syncing more often than they should. How the Windows Time service actually works, how to find out what it is doing with w32tm and the event log, how to fix standalone machines, domain members and the PDC emulator, and how to use a Linux box running chrony (or ntpd/NTPsec) as a reliable time source for Windows.
Where (and why) it all began While trying to join an Ubuntu client to my Samba domain, I got this error that most likely prevented a successful login. From the sssd’s log files I got this as a first hint: So it looks like we got a problem with my Samba domain not serving GPO […]
While trying to get radius working with my Samba domain controller, I was looking for a way to get attributes like radiusTunnelPrivateGroupId into it. In the end the solution was something completely different, but anyhow: Here’s what I did to raise the domain level (and as it turns out the function and forest level) of […]
Categories
Unattended Windows ISO
For one or another reason even Linux enthusiasts need a Windows installation from time to time. But with every new version Microsoft adds more and bloatware or privacy violating settings that you need to decline during installation in order to get a halfway usable system. The same is true for forced requirements of TPM or […]