Group Policy – Time is of the essence !!


I ran GPupdate today on one of my Windows 7 machines and got this.. . ..


It’s kind of a mouthful, but here’s the “short, sweet” story here.

Group Policy relies on the Kerberos protocol. Kerberos relies on the clock. If the clock between your client and your server is skewed by more than the allowable value (normally 5 minutes) then you won’t process GPOs correctly !

So, this warning, is saying: “My clock is weird versus the domain controller’s.”

No problem. Usually, a reboot fixes this kind of thing. Or it gets fixed on it’s own when the time sync service does its thing.

But, one of the key troubleshooting steps for GPOs is to VERIFY that your client’s time is within 5 minutes of your DCs’ times.

Do this, and you’re off and running (sometimes.) 🙂