2

According to this page:

Be aware that the Network Time Protocol (NTP) is unauthenticated, and unencrypted, and it is possible for an intruder to spoof the time root source, causing the wrong time to be set on the DC.

Now according to an article on configuring time servers for DCs, loss of service can be caused when the time on a DC changes:

Active Directory can't work correctly (or at all) if the clock is not synchronized around domain controllers/member machines.

For example, in Kerberos V5, computers that are more than 5 minutes out of sync will not authenticate (which is configurable by GPO: Maximum tolerance for computer clock synchronization in Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy).

Another example is replication, Active Directory uses time stamps to resolve replication conflicts.

Say an attacker is sitting on a network and for whatever reason decides to spoof the NTP traffic and cause a DOS attack. Potentially, users could not access some databases, log into their machines, and a variety of other things could occur. Are there any checks in place for such a thing, or does the server assume that the sysadmin is using IPsec / other security measures, as suggested by the first article? Would some things break instantly, such as databases, while Kerberos or AD tombstones would take a while to cause problems?

I'm pretty new to messing with domains at all, this was just something I wondered about while fixing a time problem on a network.

Improve this question

1 Answer 1

Reset to default
2

Yes, in theory, you could significantly disrupt Kerberos (which is time sensitive) by blocking time or sending strange time answers in response to requests. This is why AD has moved to authenticated time, and mostly abandoned SNTP. Mind you, NTP (on which authenticated time and SNTP are based) uses quorum-counting, so you would have to disrupt multiple time sources or spoof answers from a majority of the time sources.

Improve this answer
2
  • Thanks for the info - as an AD / server newbie, I didn't know about authenticated time or quorum-counting
    – cutrightjm
    Dec 19, 2014 at 2:28
  • Authenticated time is built into AD and is transparent. Quorum-counting is built into NTP, and is essentially the practice of querying for time from an odd number of time-source servers and requiring for more than half to agree to consider the time valid.
    – DTK
    Dec 28, 2014 at 17:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .