0x80CF0437 means the clock on the client computer isn't set to the correct time. Every step of
enrolment depends on time: tokens carry nbf and exp claims, and certificates carry validity
windows. A device whose clock is skewed by more than a few minutes presents credentials that the
service reads as not-yet-valid or already expired.
0x80CF0437
The client computer's clock is wrong
What it means
Common causes
The system clock is wrong, often after a CMOS battery failure or a long period powered off.
The time zone is wrong, putting UTC out by whole hours even though local time looks correct.
The device cannot reach a time source — NTP blocked outbound, or a domain-joined device that has lost contact with the PDC emulator.
How to fix it
Set the clock and the time zone correctly on the client computer, then retry enrolment.
Confirm time synchronisation is working:
w32tm /query /statusshows the current source, andw32tm /resyncforces an update.Where a fleet is affected, check that outbound NTP (UDP 123) is permitted, or that domain members can reach the PDC emulator — a single broken time source produces this across many devices at once.