The Juniper Identity Management Service (JIMS) collects user identity information by querying security event logs from Active Directory (AD) domain controllers. If multiple domain controllers are being queried and their system clocks are not synchronized, the timestamps recorded for user login events will be inconsistent. When JIMS aggregates these logs, it results in events appearing out of chronological order, causing operational issues. Synchronizing the time across all domain controllers ensures that the source event logs have consistent timestamps, directly resolving the problem.

A. Enable time synchronization on the client devices: The domain controller, not the client, creates the security event log entry with its own timestamp when a user authenticates.

B. Enable time synchronization on the JIMS server: The JIMS server is the consumer of the event logs. Synchronizing its clock does not correct the inconsistent timestamps within the source logs it receives.

D. Enable time synchronization on the SRX Series devices: The SRX device uses the identity information from JIMS for policy enforcement; it is not the source of the user authentication event logs.

1. Juniper Networks (2023). Juniper Identity Management Service (JIMS) Administration Guide. In the "Troubleshooting JIMS" section

under "JIMS Server Issues

" the guide explicitly states: "Ensure that the time on all domain controllers is synchronized. If the time is not synchronized

JIMS might receive event logs with out-of-order timestamps." This directly identifies unsynchronized domain controllers as the cause of the issue.