A Windows 11 domain member refuses to take its time from a Samba AD DC running chrony. Plain NTP works, the configuration is fine, yet the DC never answers. The cause: above functional level 2012, Windows uses the MS-SNTP extended authenticator, which neither chrony nor Samba support. I patched both, and after one more trap in the byte order, Windows now accepts the signed replies.
Tag: w32time
Windows clocks drift, jump or silently stop syncing more often than they should. How the Windows Time service actually works, how to find out what it is doing with w32tm and the event log, how to fix standalone machines, domain members and the PDC emulator, and how to use a Linux box running chrony (or ntpd/NTPsec) as a reliable time source for Windows.