Return
-
Title
Can a Unix system be joined to the domain when it's time is not in sync with the domain - clock skew too great -
Description
Is it possible to join a server to the domain on which the time has been set to earlier date? -
Resolution
There is no way to join a system to the domain with a clock skew of greater then 5 minutes. It's a fundamental requirement of Kerberos that the time be in sync, without that Kerberos cannot complete it's handshake.
If users were configured to be in perm disconnected mode It would be possible to sync the time, perform the join, set the time back and then execute:touch /var/opt/quest/vas/vasd/.force_disconnected_mode
This will force vasd into disconnected mode within 30 seconds. The feature is available on 4.1.0.21133 and above.
Another option might be to have an AD forest that ALSO thinks time is out of sync. As long as the system and the DC think its the same time, this should work.