A Windows 11 domain member refuses to take its time from a Samba AD DC running chrony. Plain NTP works, the configuration is fine, yet the DC never answers. The cause: above functional level 2012, Windows uses the MS-SNTP extended authenticator, which neither chrony nor Samba support. I patched both, and after one more trap in the byte order, Windows now accepts the signed replies.
Tag: Active Directory
Windows clocks drift, jump or silently stop syncing more often than they should. How the Windows Time service actually works, how to find out what it is doing with w32tm and the event log, how to fix standalone machines, domain members and the PDC emulator, and how to use a Linux box running chrony (or ntpd/NTPsec) as a reliable time source for Windows.
Where (and why) it all began While trying to join an Ubuntu client to my Samba domain, I got this error that most likely prevented a successful login. From the sssd’s log files I got this as a first hint: So it looks like we got a problem with my Samba domain not serving GPO […]