Fix Authentication Failed Errors

🔑

Authentication Errors

⚠ Common symptoms

"Authentication failed," "Invalid credentials," or "Access denied" on login
MFA codes generated correctly but still rejected
Works on one device but not another with the same credentials
Suddenly starts failing after a password change or policy update

1

Verify your credentials on a known-working surface

Before changing settings, log into the account via browser, not the app.

Personal account (Google, Microsoft, bank, etc.): use the provider's sign-in page → password-recovery flow if needed.

Work account: log into company web portal/webmail instead → if that fails, use provider self-service reset (personal) or contact IT (work).
2

Sync your system clock — clock skew causes auth failures

Kerberos & TOTP-based MFA need system time accurate to within 5 min of the server — 6 min of drift rejects valid credentials. On Windows, open elevated Command Prompt → run:

w32tm /resync /force

On Mac: System Settings → General → Date & Time → enable "Set automatically."
3

Re-register your MFA authenticator app

MFA codes rejected despite looking valid = authenticator app's clock has drifted. Google Authenticator: Settings → Time Correction for Codes → Sync Now. Microsoft Authenticator: syncs automatically, but reinstall + re-add account is the most reliable fix.
4

Clear saved (cached) credentials from Windows Credential Manager

Stale cached credentials override what you type at login. Open Control Panel → Credential Manager → Windows Credentials → remove entries for the system you're accessing (look for server/app name) → retry authentication.
5

Check for certificate or TLS issues

Some auth failures are TLS handshake failures misreported as credential errors — check the app's error details for expired/untrusted certificate warnings.

Work device: often an expired root certificate on your company's SSL inspection proxy → IT needs to update it.

Personal device: often Windows or antivirus needing an update, or antivirus doing its own SSL scanning → update both, or temporarily disable antivirus HTTPS scanning.

1

Verify your credentials on a known-working surface

Open Safari → sign in directly through the browser, not the app.

Personal account (Google, Microsoft, bank, etc.): use the provider's sign-in page → password-recovery flow if needed.

Work account: log into company web portal/webmail instead → if that fails, use provider self-service reset (personal) or company self-service tool/IT (work) — before making any local changes.
2

Sync your system clock — clock drift causes auth failures

Kerberos & TOTP-based MFA need your Mac's clock accurate to within 5 min of server time. Enable System Settings → General → Date & Time → Set time and date automatically → for an immediate re-sync, open Terminal and run:

sudo sntp -sS time.apple.com
3

Re-register your MFA authenticator app

MFA codes rejected despite looking correct = authenticator app's clock has drifted. Google Authenticator: Settings → Time Correction for Codes → Sync Now.

Microsoft Authenticator: syncs automatically, but reinstall + re-add your work account via your company's MFA registration portal is the most reliable fix for persistent rejections.
4

Remove stale credentials from macOS Keychain

macOS stores saved passwords/tokens in Keychain — old entries from before a password change silently override what you type at login.

Open Keychain Access (Spotlight → Keychain Access) → search server hostname/app name/company domain → delete entries older than your last password change or that look duplicated → retry authentication. macOS will prompt for fresh credentials.
5

Check for certificate or TLS errors

Some auth failures are TLS handshake errors misreported as "wrong password." In Safari, click Show Details on any certificate warning → check issuer and expiry date.

Work Mac: often your company's SSL inspection proxy with an expired root certificate → IT needs to renew it.

Personal Mac: often macOS itself needing an update, or third-party security software doing its own SSL scanning. Also check Keychain Access → System keychain → Certificates for anything expired/untrusted.

1

Verify credentials on a known-working surface

# Test login via curl (e.g. check web portal response)
curl -v -u username:password https://your-company-portal.com

# Test Kerberos ticket (if using Active Directory)
kinit username@DOMAIN.COM
klist
2

Sync your system clock

# Check current time and NTP sync status
timedatectl status

# Enable automatic NTP sync
sudo timedatectl set-ntp true

# Force immediate sync
sudo systemctl restart systemd-timesyncd
timedatectl show-timesync --all

Kerberos (corporate Active Directory environments) requires clock accuracy within 5 minutes of the server.
3

Re-sync your MFA authenticator app

Google Authenticator: open app → three-dot menu → Time correction for codes → Sync now. Microsoft Authenticator: reinstall + re-add account is the most reliable fix if codes are rejected despite appearing valid.
4

Clear saved credentials from the keyring

# Open Seahorse to find and remove the specific stale entry
sudo apt install seahorse -y
seahorse

# Clear Kerberos ticket cache (safe — only affects Kerberos tickets)
kdestroy

In Seahorse (Passwords and Keys): Passwords → Login → search for the specific server/app you can't authenticate to → delete only that entry. Avoid deleting the whole keyring file (e.g. rm -rf ~/.local/share/keyrings/*.keyring) — it also stores unrelated saved passwords like Wi-Fi and other apps, and wiping it removes those too.
5

Check for certificate or TLS issues

# Test SSL/TLS handshake and certificate chain
openssl s_client -connect your-server.com:443 -showcerts

# Update CA certificates if corp root CA is expired
sudo update-ca-certificates

# Add a corporate root CA to the trusted store
sudo cp corp-root-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

💡

Quick check: If the same credentials work fine on your phone but fail on your laptop, the issue is almost always clock drift or cached credentials on the laptop specifically — start with steps 2 and 4.

❓

Authentication Errors

Authentication Errors

⚠ Common symptoms

Verify your credentials on a known-working surface

Sync your system clock — clock skew causes auth failures

Re-register your MFA authenticator app

Clear saved (cached) credentials from Windows Credential Manager

Check for certificate or TLS issues

Verify your credentials on a known-working surface

Sync your system clock — clock drift causes auth failures

Re-register your MFA authenticator app

Remove stale credentials from macOS Keychain

Check for certificate or TLS errors

Verify credentials on a known-working surface

Sync your system clock

Re-sync your MFA authenticator app

Clear saved credentials from the keyring

Check for certificate or TLS issues

Related Questions

Still locked out? A technician can check what you can't access.

Authentication Errors

Authentication Errors

⚠ Common symptoms

Verify your credentials on a known-working surface

Sync your system clock — clock skew causes auth failures

Re-register your MFA authenticator app

Clear saved (cached) credentials from Windows Credential Manager

Check for certificate or TLS issues

Verify your credentials on a known-working surface

Sync your system clock — clock drift causes auth failures

Re-register your MFA authenticator app

Remove stale credentials from macOS Keychain

Check for certificate or TLS errors

Verify credentials on a known-working surface

Sync your system clock

Re-sync your MFA authenticator app

Clear saved credentials from the keyring

Check for certificate or TLS issues

Related Questions

Still locked out? A technician can check what you can't access.

Other Issues You Might Be Hitting

VPN Keeps Disconnecting

Website Blocked

Printer Offline / Not Printing