First published on TECHNET on Feb 28, 2007
Q: what happens post 2am on 3/11 if domain controller server has O/S patch but a workstation O/S doesn't  - the workstation clock will be off by more than 5 minutes ... will user be able to access network?
A: Internally Windows uses UTC for time. Kerberos also uses UTC and as such, won’t be out of sync; unless a user "fixes" their clock by setting it, in which case they have now changed their UTC time and will break Kerberos.