Live Meeting 2007 client - sign in fails due to a out of range time setting

When you try to join a Microsoft Office Live Meeting 2007 session as a domain user, the operation is unsuccessful. Additionally, the following response is logged in the ConfAPI-uccp-0.uccplog file on the Windows-based Live Meeting 2007 client:

This problem occurs if the following conditions are true:

• The time on the Windows-based Live Meeting 2007 client differs by more than five minutes from the time on the Active Directory domain.
• The Active Directory domain hosts Microsoft Office Communications Server.
• The Communications Server pool that hosts the Live Meeting is using the default Kerberos authentication method.

This problem occurs because the time on the Windows-based Live Meeting 2007 client is not synchronized with the time on the Active Directory domain that hosts Office Communications Server .

To resolve this problem, make sure that the time on the Windows-based Live Meeting 2007 client differs by fewer than five minutes from the time on the Active Directory domain that hosts Office Communications Server. Typically, Kerberos authentication requires this condition.

Note After you change the time on the Live Meeting client computer, you may have to delete the cache of Kerberos tickets. For more information about how to do this, visit the following Microsoft website:

To locate the ConfAPI-uccp-0.uccplog file, follow these steps from the desktop of the Windows client that is experiencing this issue:

1. Click Start, and then click Run.
2. Enter%userprofile%\Tracing, and then click OK.
3. In Windows Explorer, search for the ConfAPI-uccp-0.uccplog file.

The "Resolution" section addresses issues that concern the Kerberos authentication protocol's time-skew requirement. Kerberos authentication fails if the client computer's time does not match (within five minutes) the time that is set on the Kerberos Key Management server or on the Active Directory domain controller. If the Windows client computer's time differs by more than five minutes from the time on the Kerberos Key Management server or on the Active Directory domain controller, the Windows client computer cannot access resources on the network. For more information, visit the following Microsoft website:Remote Live Meeting 2007 clients use just NTLM authentication to access internal network resources such as Office Communications Server Instant Messaging, Address Book Service, and conferencing features. The issue that is described in the "Symptoms" section does not apply to remote Live Meeting 2007 clients that are trying to sign in to the internal Office Communications Server networks through the Office Communication Server Access Edge server. If your issue applies to a remote Live Meeting 2007 client, review the Office Communications Server External User Access information by visiting the following Microsoft websites.

Microsoft Office Communications Server 2007 R2Office Communications Server 2007 Edge Server Deployment Guide For more information about how the Windows time service works, visit the following Microsoft website: For more information about how to configure the Windows Time service against a large time offset, click the following article number to view the article in the Microsoft Knowledge Base:

For more information about other issues may occur when you try to join a Live Meeting 2007 session, click the following article number to view the article in the Microsoft Knowldedge Base:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.