Error message when you try to log on to a Windows Vista-based client computer across a domain trust: "There is a time and/or date difference between the client and server"

Consider the following scenario. You have a domain on which user accounts reside and another domain on which computer accounts reside. You have established a trust relationship between these domains. However, when you try to log on to a Windows Vista-based client computer across the trust, the logon process fails. Additionally, you receive an error message that contains a white “X” inside a red circle. The text of this error message resembles the following:Note This issue occurs even though there is no significant time difference between the client computer and the server. This issue occurs only on Windows Vista-based client computers.

This issue occurs on Windows Vista-based client computers if the following conditions are true:

• The Do not require Kerberos preauthentication check box is selected for the user account.
• The domain controller that manages the Active Directory user accounts contains the following version of the Kdcsvc.dll file or an earlier version:
  kdcsvc 5.2.3790.2464 (srv03_sp1_rtm.050324-1447)

To resolve this issue, install Microsoft Windows Server 2003 Service Pack 2 (SP2) on the domain controller that manages the Active Directory user accounts. For more information about how to obtain the latest service pack for Windows Server 2003, click the following article number to view the article in the Microsoft Knowledge Base:

To work around this issue, click to clear the Do not require Kerberos preauthentication check box in the User Properties dialog box on the domain controller. To do this, follow these steps:

1. In the Active Directory Users and Computers snap-in, expand Users.
2. Right-click the affected user’s account, and then click Properties.
3. On the Account tab, click to clear the Do not require Kerberos preauthentication check box in the Account options list, click Apply, and then click OK.
4. Close the Active Directory Users and Computers snap-in.
5. Verify that the affected user can successfully log on to the domain.