The first report says users cannot log in. The directory is reachable, the accounts are active, and password resets change nothing. The identity team checks the logs and sees Kerberos rejections. They check the network. The network is fine. The actual cause is that the client workstation and the domain controller disagree on the time by six minutes. Active Directory does not care that the network is up or that the user knows their password. The ticket is rejected because it looks like a replay.
Time is the shared dependency nobody procures. Every system assumes it. Almost no one writes a requirement for it. A GPS antenna on a roof is a timing device, and half the people who walk past it think it is for maps. A clock that is wrong does not announce itself. A down server pages someone. A clock that is seven minutes off looks perfectly healthy until the moment it needs to be right.
Kerberos tickets carry timestamps to prevent replay attacks. The default skew tolerance in most implementations, including Active Directory, is five minutes. If the client and server drift past that window, authentication fails. Raising the tolerance via policy widens the replay window; it does not fix the clock. The same logic applies to transport security. Every TLS client checks a server certificate against its own local clock. A clock in the past makes current certificates look not yet valid. A clock in the future makes them look expired. A field laptop sitting in a drawer over a long weekend with a dead CMOS battery will boot to a date years in the past and reject every HTTPS connection.
Architects draw diagrams for network routing and identity replication. They rarely draw the hierarchy of where servers get their time. A headquarters might have two NTP servers in different racks. That arrangement protects against one server failing. It does not establish an independent reference if both servers take their time from receivers connected to the same rooftop installation. Redundancy in the server room can conceal a single dependency on the roof. When a contractor replacing roof membrane disconnects the antenna and reconnects it to the wrong port, the primary time source goes into holdover. Over a weekend, the local oscillator drifts. A scheduled job comparing timestamps across two systems runs in the wrong order. The output is wrong and plausible. Nobody catches it until month-end reconciliation.
In operational environments, the physical loss of a GNSS signal introduces a different set of failure modes. Jamming and spoofing are distinct problems. Jamming causes a loss of lock. The receiver knows it has lost the signal, and the disciplined oscillator goes into holdover. The clock drifts from a good starting point, but the drift is bounded by the quality of the local oscillator. Holdover is the gap between losing the sky and losing the network.
Spoofing is an integrity problem. The receiver locks onto a false signal. Holdover never engages. The clock follows the lie and reports itself as healthy sync. Unauthenticated NTP traffic is trivially spoofable on a local network. Even with authenticated NTP, the protocol only protects the path between the client and the server; it cannot prove that the server’s upstream reference is correct.
The operational consequence of a lost time source depends entirely on the hardware inside the time server. The difference between a temperature-compensated quartz oscillator and a rubidium atomic clock is a few thousand dollars. Procurement often cuts the rubidium to save money. A standard crystal oscillator drifts milliseconds per minute. An oven-controlled crystal reduces that to microseconds per day. A rubidium oscillator keeps a system within milliseconds of UTC for weeks. The datasheet number is a starting point, not a guarantee for an aging unit sitting in a hot rack. Hardware dictates the decay rate of your network’s reality. If a mobile command post loses its GNSS feed, a cheap oscillator gives you hours before the domain controller bricks itself by refusing all authentication requests. A rubidium standard gives you weeks.
The failure cascades beyond authentication into the chain of custody. In an investigation, a timestamp is not metadata. It is part of the proof. A review team pulling logs from tactical radios, body cameras, drone feeds, and central dispatch expects a single timeline. If the dispatch system synced to a stratum 1 server, the drone synced to GNSS, and the body cameras synced to whatever laptop they were last plugged into, the timeline of events is obscured by a multi-second variance across devices. A defense lawyer does not need to disprove digital evidence. They just need to prove the servers disagree on when it happened. Logs with bad timestamps are not evidence. They are fiction. You can fix a clock. You cannot fix a timeline that was recorded on a clock you cannot trust.
Fixing this requires treating time as a supply chain rather than a default setting. The first step is to inventory the time chain end to end. Map the reference, the distribution layer, and the consumers. Name the owner of each hop. If the network team runs NTP, the Windows team runs the domain hierarchy, and facilities owns the antenna, the chain crosses all four and belongs to none. Someone has to own the chain, or the failure is nobody’s until it is everyone’s.
Write a time requirement, not just a GPS requirement. Know the error budget for each consumer. Kerberos needs minutes. Log correlation needs seconds. Sensor fusion needs nanoseconds. If you do not know the budget, you cannot design the chain. Monitor disagreement between references, not merely whether an NTP service responds. A spoofed receiver reports healthy sync. You need a second, independent reference and a threshold that pages someone when the offset exceeds the error budget. Finally, test the outage. Disconnect the antenna in a maintenance window. Observe authentication, certificate validation, and application behavior separately. Still running and still producing usable timestamps are different findings.
The network will keep passing packets long after the clocks stop agreeing on the time.