A Windows 11 domain member refuses to take its time from a Samba AD DC running chrony. Plain NTP works, the configuration is fine, yet the DC never answers. The cause: above functional level 2012, Windows uses the MS-SNTP extended authenticator, which neither chrony nor Samba support. I patched both, and after one more trap in the byte order, Windows now accepts the signed replies.
Linux - The Next GenerationOpen Source, Linux, IT Stuff