High Sierra time / kerberos issue

[jalbert]

We just reimaged our student macbook pros with High Sierra in the summer. Now, when they leave the computer on and put it back in the cart at night, the next day, the students cannot log in because the time is off on the laptop.

We didn't have this problem with Sierra or older versions.

My understanding is that it will try to resync within 15 minutes but even after a reboot, it isn't trying to get an updated time right away. So, for the laptops that aren't powered down at night, they have to set them aside for a while to get a proper time sync.

Anybody have a fix for this

[leeskade]

Are they pointing to your AD as time server? Something did change in High Sierra around date and time as you we where unable to script a secondary timeserver like we could in Sierra.

You could run a login hook to run a time sync.

[jalbert]

We are still using Open Directory for authentication at this point, we want to go to AD but decided not to this year (maybe we should have afterall). I will look into the login hook to see if that helps. We are calling Apple today and will update with any information that they give me.

[Michael_Meyers]

I created a policy for all computers triggered by Startup and Network State Change and added a command in Files and Processes to sink with our internal time server. This is the same server that our AD server syncs to. The command is ntpdate -u yourtimeserver . This has fixed a majority of our "network accounts are unavailable" errors at login. In your case, I agree with adding a Login trigger. The time server would be the same one that your OD syncs to.

[Nix4Life · Accepted solution]

See my workaround/explination in this post