because every developer has been told to never trust user input, and to sanitize the hell out of it.

There are public users and owner users. Specifically, you don't trust input from public users. You absolutely should trust input from owner users, or if you won't by default for some reason, you absolutely should give them the option to do so. Primarily, you should be giving them the choice as to what their system will do when it cannot reliably determine the actual time.

The alternative is to pretend that you can somehow divine a 'projected secure time.' Just, the gall to even write a sentence like that.

If your goal is to phase out local accounts and force microsoft.com logins as part of the computer setup, being able to trust your certificates seems like a prerequisite to being able to trust your users. And the correct time is a prerequisite to trusting your certificates.

This makes no sense..? If the admin wants to change the clock to something else and make their certs invalid, they can always do so. It's just for getting an initial handshake, and then after that NTP should keep working (at least until the next reset with a dead CMOS battery).

There's no way for the server to accurately determine the client's hardware clock, barring some sort of user-hostile hardware clock with a nuclear battery or hardened GPS or radio time receiver or something.

>'projected secure time.'

It's 5 o'clock somewhere!

It’s 1970-01-01T00:00:00Z somewhere

But the user input thing is not the rule, its a specific case of the more general rule regarding external data generally.

It definitely applies even more to the data it is trusting in this case.

If I understood the article correctly, this misfeature is for the rare case in which the server reboots after a power loss and the real-time-clock battery on the motherboard is dead, which can happen long after the initial setup of the server.

This is a hardware failure. The server should report to the domain controller a malfunction (by assuming it's certificate is valid) and then give up.