NTLM is being replaced by Kerberos. Kerberos has requirements about clocks being synchronized such that clock skew will prevent authentication. I rather doubt

NTLM is being replaced by Kerberos. Kerberos has requirements about clocks being synchronized such that clock skew will prevent authentication. I rather doubt that Microsoft has made Windows any more punctual about setting its damned clock even if you give it a time server and tell it to set its time from the network. Even if the behavior I observed was somehow rare, there's still the matter of local IT "gurus" needing to punch holes in firewalls sufficient to enable NTP and/or being punctual about setting clocks. This is going to be fun.