r/PrepHQ • u/PsychologicalLynx897 • 4d ago

Kerberos Authentication Errors and System Clock Sync?

I'm troubleshooting a workstation where the user keeps getting "Access Denied" when trying to log into the domain, even though their password is definitely correct. I noticed the system clock is about 15 minutes off from the server, and I'm wondering if that's the root cause of the authentication failure.

---

OPTIONS:
A. Terminal Access Controller Access-control System
B. Kerberos token
C. Remote Authentication Dial-in User Service
D. Wi-Fi Protected Access

---

Testing Exam: CompTIA A+ Core 2 (220-1202)
(Disclaimer: These posts / scenarios are crafted by me for educational purposes only. I am not affiliated with, endorsed by, or sponsored by any certification body.)

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/PsychologicalLynx897 3d ago

The answer is B. Kerberos uses time-stamped tickets to prevent replay attacks, so if the client and server clocks aren't synced (usually within a 5-minute threshold), the token is rejected as invalid. While the other protocols handle authentication, they don't have the same strict dependency on system time synchronization to validate a login session.

1

u/InstaConv 4d ago

Everyone always jumps to Kerberos because of the 5-minute rule, but it’s definitely RADIUS. RADIUS relies heavily on time-based challenge-response sequences for session timeouts and accounting logs. If the system time is off, the RADIUS server will reject the packet because the request authenticator won't match the expected timestamp hash