@@ -145,7 +146,7 @@
Troubleshooting Case Studies
Observed issues, diagnostic work, and verified outcomesVerified Fix: Domain trust failure
+Test-ComputerSecureChannel failed while WIN11-01 was on the wrong VMware network.
Fix: Returned the client to VMnet8, restored DC01 as DNS, repaired the secure channel, then verified with Test-ComputerSecureChannel and nltest.
Verified Fix: PDC time source
+w32tm /query /source reported Local CMOS Clock on the PDC Emulator.
Fix: Configured external NTP peers, resynchronized Windows Time, then verified time.windows.com as the active source.
PDC Emulator using its local CMOS clock
Problem: An AD domain controller reported Local CMOS Clock as its time source. Unreliable domain time can lead to Kerberos clock-skew failures.
Action: Checked the source with w32tm, configured external NTP peers, restarted Windows Time, and resynchronized.
Restoring a broken domain secure channel
Problem: WIN11-01 was bridged onto the physical LAN and could not reach DC01 on the VMware NAT subnet. Trust repair initially failed.
Action: Changed the VM network to NAT, pointed client DNS at DC01, and repaired the machine-account trust.