When a token is not producing OTP codes that match those generated using an online TOTP generator (using the seed/secret and token period for your pre-programmed token), then it is possible that the built-in clock on the pre-programmed token has drifted from the actual time.
Time drift on a pre-programmed token is to be expected, and token clocks will typically drift by approximately 1 minute every 6 months since purchase (the amount of drift can vary, but this is a good rule of thumb).
If your token has less than 10 minutes of drift, then it is still likely that the token can be registered for use with authentication servers (such as those used by Microsoft for Entra and Office 365) provided. you perform a manual activation of the token (see the "Activate Tokens" section of the following wiki guide);
Once the token has been manually activated, and provided the token is used more than once every few months, then any additional drift is likely to be accounted for (most servers follow the full RFC 6238 guidance that caters for addition drift on hardware tokens after registration).
One method we can use to check for time drift on our hardware tokens is to use an online TOTP generator to validate the OTP codes produced by our tokens.
Whilst our online testing TOTP generator can be used to confirm if time drift exists on the token, if drift is detected, then we still need to identify how much the clock on the token has drifted.
Fortunately, we do have a tool that can be used for this task - the CHECK CLOCK DRIFT tool;
The following procedure provides instruction on how to check the extent of time drift on a token;
|
If there is a small amount of time drift you should find that the code displayed on the token is also listed in the list of OTP codes shown on this window.
In this test we will identify the extent of drift on a SafeID Classic token with serial number "102601103200"
|
