What is time drift?
A computer keeps time in two places. While it is off, a real-time clock (RTC) on the motherboard, powered by the CMOS battery, keeps counting. While it runs, the operating system keeps its own clock, starting from the RTC and correcting it against time servers with the Network Time Protocol (NTP, UDP port 123). The crystal oscillators behind both clocks are imperfect, so without regular correction the time wanders by seconds a day or more. Time drift is that gradual error. A clock that is wrong by an exact number of hours is usually a wrong time zone instead.
Why a few minutes matter
- Domain sign-in: Kerberos rejects requests when the client and domain controller clocks differ by more than the allowed skew, 5 minutes by default. Users see sign-in or trust failures, and logs may show a clock skew error (KRB_AP_ERR_SKEW).
- Certificates and HTTPS: if the clock falls outside a certificate's valid dates, browsers warn on many sites at once. A date error such as NET::ERR_CERT_DATE_INVALID across several sites points to the local clock, not the websites.
- MFA codes: time-based one-time passwords (TOTP) are valid for short windows, usually 30 seconds, so a device with a drifting clock produces codes the server rejects.
- Logs and evidence: events from different machines no longer line up, which slows troubleshooting and confuses incident timelines.
- Schedules and sync: tasks run at the wrong time, and file sync can pick the wrong copy as newest.
Common causes
| Clue | Likely cause |
|---|---|
| Clock resets to an old date after the PC loses power | Failing CMOS battery |
| Time slowly wrong and sync never succeeds | Windows Time service stopped, NTP blocked by a firewall, or a bad time source |
| Domain PC drifts or keeps changing back | Not syncing through the domain hierarchy, or a local setting fighting Group Policy |
| Hours off after starting another OS | Dual boot: Windows keeps local time in the RTC, Linux usually keeps UTC |
| Virtual machine wrong after a pause or snapshot restore | Guest not resyncing; check the hypervisor's time sync feature and the guest's NTP setup |
| Off by exactly one or more hours | Wrong time zone or daylight saving setting, not drift |
Fixing it on Windows
- In Settings > Time & language > Date & time, confirm the time zone, turn on Set time automatically, check the last successful sync and click Sync now.
- Confirm the Windows Time service (W32Time) is running in
services.msc. - From an elevated Command Prompt,
w32tm /query /statusshows the current time source and last sync, andw32tm /resyncforces a sync right away. w32tm /stripchart /computer:time.windows.com /samples:5measures the offset from a server without changing anything.- If the time is wrong after every cold start, check the clock in UEFI setup and replace the CMOS battery.
Domain time hierarchy
In Active Directory, member computers sync from domain controllers, and domain controllers sync up to the PDC emulator of the forest root domain, which should take its time from a reliable external source. Setting a public NTP server by hand on a domain member works against this design and may be overwritten by policy. Fix the hierarchy instead, starting at the PDC emulator.
Other systems
On Linux, timedatectl shows whether the system clock is synchronized and whether an NTP service (often chrony or systemd-timesyncd) is active. Phones take time from the carrier network and internet servers; with automatic time turned off, app sign-ins and store downloads can fail certificate checks.
Time drift on the CompTIA A+ exam
Time drift appears in Core 2 (220-1202) objective 3.1, troubleshooting Windows. Know the symptoms (domain sign-in failures, certificate warnings, wrong timestamps), the causes (CMOS battery, failed NTP sync, VM and dual-boot quirks) and the fixes (time settings, the Windows Time service and w32tm /resync). If users suddenly cannot sign in to the domain and the PC clock is several minutes off, think Kerberos and time drift. If the time resets whenever the PC loses power, think CMOS battery.