220-1102 Question 401
Single answerKerberosA technician joins a Windows 11 laptop to the company domain. The user can sign in to Windows with their domain account, but when they try to access a file share on a domain server, they receive an authentication error. The technician verifies the username and password are correct and notices the laptop's system clock is 12 minutes ahead of the domain controller. Which action is MOST likely to resolve the problem?
- A
Synchronize the laptop's date and time with the domain controller or network time source
- B
Disable NTFS permissions on the file share and rely only on share permissions
- C
Reinstall the network adapter driver on the laptop
- D
Switch the file server from Kerberos to LDAP authentication
Show answer and explanation
Correct answer: A
Explanation
This scenario tests practical knowledge of Kerberos in an Active Directory environment. Kerberos uses time-based tickets issued by the Key Distribution Center (KDC), which is typically running on a domain controller. If the client clock differs too much from the domain controller's clock, Kerberos may reject the authentication attempt to help prevent replay attacks. In Microsoft environments, the default maximum clock skew is commonly 5 minutes, so a 12-minute difference is enough to cause failures when accessing domain resources such as file shares. Best practice is to ensure domain-joined systems synchronize time automatically through the Windows Time service with the domain hierarchy or an approved NTP source. Microsoft documentation on Kerberos authentication and Windows Time service supports time synchronization as a critical requirement for successful Kerberos operation.
- A. Correct.
Correct. Kerberos authentication is time-sensitive and depends on the client and domain controller having closely synchronized clocks. In Active Directory environments, a time difference greater than the allowed skew can cause ticket requests or ticket validation to fail, even when the user's credentials are correct. Correcting the laptop's time and syncing it with the domain time source is the most likely fix.
- B. Incorrect.
Incorrect. NTFS and share permissions control authorization, not the Kerberos authentication process itself. If the problem is caused by clock skew, changing file permissions will not resolve the underlying ticketing failure and would create an unnecessary security risk.
- C. Incorrect.
Incorrect. A bad network adapter driver might cause connectivity problems, but the scenario indicates the laptop is joined to the domain and the user can sign in, which suggests general network communication is working. The specific clue is the 12-minute clock difference, which points to Kerberos time synchronization rather than a driver issue.
- D. Incorrect.
Incorrect. LDAP is a directory access protocol, not a replacement for Kerberos authentication in this scenario. In a Windows domain, Kerberos is the default authentication protocol for domain logons and access to domain resources. Changing authentication methods on the server would not be the proper first-line fix for a client clock skew issue.