Because Kerberos is very time sensitive you should configure your client machines to use one of your domain controllers as an NTP server. The DigitalOcean link further down recommends using
ntp instead of
systemd-timesyncd due to some optimized "smoothing" algorithms that prevent weird clock jumps that can break some applications "timestamp in the future, session aborted, etc".
If on a system with
sudo gedit /etc/systemd/timesyncd.conf and uncomment
NTP= and set your list of space separated servers to try, if you have laptops that may not be on VPN to access the domain controllers you should also set the
FallbackNTP= to include something like pool.ntp.org or other public NTP servers.
sudo systemctl restart systemd-timesyncd to put the new changes into effect without rebooting.
If on a system without
sudo apt install ntpdate
sudo gedit /etc/default/ntpdate
You will probably need to add a cron entry to run this daily for long running machines. You could also use ntp directly per this excellent DigitalOcean document, https://www.digitalocean.com/community/tutorials/how-to-set-up-time-synchronization-on-ubuntu-16-04
If you also have ntp installed, ntpdate-debian (ntpdate package with some tweaks from the upstream for debian/ubuntu) can also use
/etc/ntp.conf, see the
/etc/default/ntpdate file's comments.