A Windows Server 2022 member server suddenly stops accepting Kerberos tickets for shared folders on Monday morning. The System log records multiple Event ID 4 entries with status KRB_AP_ERR_SKEW. You confirm that the server's clock is seven minutes behind the domain controller and have already fixed the underlying NTP configuration. To force the server to synchronize its clock immediately instead of waiting for the next polling interval, which built-in command should you run from an elevated Command Prompt on the affected server?
The Windows Time Service (W32Time) is the supported mechanism for keeping domain-joined computers synchronized. Running "w32tm /resync" tells W32Time to contact its configured time source and adjust the local clock right away, eliminating the Kerberos skew that caused the authentication failures. The "net time" command is deprecated and not recommended for domain members; it would also require specifying a remote server. "ipconfig /registerdns" merely updates DNS records and has no effect on system time. "sfc /scannow" checks protected system files and also does not influence the clock.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the KRB_AP_ERR_SKEW error, and why does it occur?
Open an interactive chat with Bash
How does the 'w32tm /resync' command work in Windows Server?
Open an interactive chat with Bash
Why is 'net time' considered deprecated for time synchronization on domain servers?