I'm experiencing this more frequently lately with my domain where the clients aren't "synchronized" with the PDC. Their time actually is within the 10 minute window but it says it isn't. Here's a screenshot of a new PC I just setup and tried to join it to the domain. KTHROWER on the left is the client, APP2 on the right is the PDC. It's only seconds different.
Yes if I do "net time /setsntp:app2" it corrects the problem. PCs that log in daily are within a minute difference and are not being able to log in. To me, it seems like something is a matter with the PDC since even PC's that have never been joined to the domain have a problem. Can anybody assist?