NTP check

What it does: asks an NTP server for the time (SNTP over UDP/123) and reports how far off this machine's clock is, plus the server's stratum.

Safe to run: yes, read-only — it only asks the time. It opens on the public pool.ntp.org, so that question goes outside your network; type your own NTP server to keep it inside.

Reading results: 'offset' is (server clock − this PC). A large offset means your clock is wrong — fix time sync before chasing TLS-cert, Kerberos/AD-auth, or log-timestamp errors, which all break when the clock drifts. Stratum is the server's distance from a reference clock (1 = best, 16 = unsynchronized). The result shows the three numbers (offset with its direction, round trip, stratum) and a verdict: in sync (under 1 s); warn (over 1 s — certificates, logs and MFA codes start to disagree); bad (over 5 minutes — Kerberos / Active Directory sign-ins fail; or the server reports stratum 16 / 0, i.e. it isn't synchronized itself).