Detections
Analytics
WN25-DC-000060 - Windows Server 2025 computer clock synchronization tolerance must be limited to five minutes or less.
Information
This setting determines the maximum time difference (in minutes) that Kerberos will tolerate between the time on a client's clock and the time on a server's clock while still considering the two clocks synchronous. To prevent replay attacks, Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server must be in sync as much as possible.Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058
Solution
Configure the policy value in the Default Domain Policy for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> Maximum tolerance for computer clock synchronization to a maximum of '5' minutes or less.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R1_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r1
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-2(8), CAT|II, CCI|CCI-001941, Rule-ID|SV-278137r1182079_rule, STIG-ID|WN25-DC-000060, Vuln-ID|V-278137
Plugin: Windows
Control ID: d8df6742dfa0640cbba442bfbe22599b794850cdff109cfd0dc47d0d1a2bb8f1