Why Does This Happen?
When using a Self-Managed Agent, communication with Liongard’s platform is time-sensitive. If the Agent machine's clock is out of sync with UTC by more/less than 15 minutes (900,000 ms), authentication fails.
This will be reflected in the Agent logs with a detailed error, indicating that the request time differs too much from the server time.
Steps to Resolve
1. Initial Troubleshooting
Before checking logs, perform these standard steps:
Run Inspector in Debug + Clear Cache Mode
Go to the affected Inspector.
Select Run > Debug + Clear Cache.
Restart the Liongard Agent Service
Open Services.msc on the Agent host.
Locate Liongard Agent → Right-click and choose Restart.
Reinstall the Agent (if needed)
Uninstall the existing Agent.
Download the latest Agent installer from Liongard.
Reinstall and re-register the Agent.
If issues persist, proceed to log review.
2. Check Logs for Time Skew Error
On the Agent host machine, navigate to:
C:\Program Files (x86)\Liongard\Liongardinc\Logs
Open the most recent
error.log
file in a text editor.Search for the following entries:
Sample Error Message
{ "$fault": "client", "$metadata": { "httpStatusCode": 403 }, "Code": "RequestTimeTooSkewed", "MaxAllowedSkewMilliseconds": "900000", "RequestTime": "20250411T132358Z", "ServerTime": "2025-04-11T14:23:59Z", "level": "error", "message": "The difference between the request time and the current time is too large.", "name": "RequestTimeTooSkewed", "stack": "RequestTimeTooSkewed: The difference between the request time and the current time is too large." }
🛑 This confirms a system time mismatch (skew) between the Agent and the Liongard platform.
3. Correct System Time on Agent Machine
To fix the skew:
Option 1: Command Line Sync
Open Command Prompt as Administrator and run:
w32tm /resync
If it fails:
net stop w32time net start w32time w32tm /resync
Option 2: Windows Settings
Go to Settings > Time & Language > Date & Time.
Toggle Set time automatically to ON.
Click Sync now.
🔒 Ensure the Agent has access to a reliable NTP server (e.g., time.windows.com
). For domain environments, confirm the domain controller is time-synced.
4. Rerun the Inspector
Once time sync is complete:
Go to the affected Inspector.
Run it in Debug + Clear Cache mode again.
The Inspector should now complete successfully.
Notes & Best Practices
Domain Environments: Agents often inherit time from domain controllers. Make sure the DC is properly syncing with an external NTP source.
Air-gapped or restricted environments: Configure time sync to an internal NTP server.
Recurring Issues: Consider enforcing GPO policies to keep system clocks accurate.