← Back to Microsoft Windows Server 2022 Security Technical Implementation Guide

V-254390

CAT II (Medium)

Windows Server 2022 computer clock synchronization tolerance must be limited to five minutes or less.

Rule ID

SV-254390r1051105_rule

STIG

Microsoft Windows Server 2022 Security Technical Implementation Guide

Version

V2R8

CCIs

CCI-001941 CCI-001942

Discussion

This setting determines the maximum time difference (in minutes) that Kerberos will tolerate between the time on a client's clock and the time on a server's clock while still considering the two clocks synchronous. To prevent replay attacks, Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server need to be in sync as much as possible. Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058

Check Content

This applies to domain controllers. It is NA for other systems.

Verify the following is configured in the Default Domain Policy:

Open "Group Policy Management".

Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain).
 
Right-click on the "Default Domain Policy".

Select "Edit".

Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy.

If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding.

Fix Text

Configure the policy value in the Default Domain Policy for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> Maximum tolerance for computer clock synchronization to a maximum of "5" minutes or less.