Fix Print Server Auth Token Expired Error (0x0000070e)

Quick answer

Sync the print server's clock with the domain controller, then restart the Print Spooler service. If that fails, rejoin the domain.

What's happening

This error shows up when the Kerberos authentication token on your print server has expired. The token is a ticket the server uses to prove its identity to domain controllers. It lasts 10 hours by default. When the server's clock drifts more than 5 minutes from the domain controller, all tokens become invalid. You'll see this error when users try to print or when the print server tries to pull group policies.

The culprit here is almost always a time sync issue. I've seen this on Windows Server 2012 R2 through 2022. Virtual machines that get paused for long periods are common triggers. Also happens after daylight saving time changes if the server doesn't sync properly.

Step-by-step fix

Check the server's clock
Open a command prompt as admin. Run:
```
w32tm /query /status
```
Look for "Source" — it should point to your domain controller. If it says "Local CMOS Clock" or "VM IC Time Synchronization Provider", you've got a problem.
Force a time sync
Run these commands one at a time:
```
w32tm /resync
w32tm /query /status
```
The second command confirms the sync. If it fails, go to step 3.
Restart the Print Spooler
In the same command prompt:
```
net stop spooler
net start spooler
```
Test printing
Send a test page from the server. If it works, you're done. If not, move to step 5.
Refresh the Kerberos ticket
Run:
```
klist purge
```
This clears all cached tickets. Then run:
```
gpupdate /force
```
This forces a new ticket request. Try printing again.

If the main fix doesn't work

Sometimes the time service is broken beyond a simple resync. Here's the backup plan:

Reconfigure the time service
Run as admin:
```
net stop w32time
w32tm /unregister
w32tm /register
net start w32time
w32tm /resync
```
This reinstalls the time service from scratch. I've fixed stubborn cases with this.
Manually set the time
If the service still fails, set the time manually from the domain controller:
```
net time \DOMAIN-CONTROLLER-NAME /set /y
```
Replace DOMAIN-CONTROLLER-NAME with your actual DC hostname.
Rejoin the domain
As a last resort, remove the server from the domain and rejoin it. This forces a new computer account password and fresh Kerberos token. Steps:
- Go to System Properties > Computer Name > Change.
- Select "Workgroup", type a name, reboot.
- Go back to System Properties, select "Domain", enter your domain name, provide admin credentials, reboot.
This always works but is a pain. Only do this if nothing else fixes it.

Prevention

Stop this from happening again with two changes:

Set the time service to sync every 30 minutes instead of the default 7 days. On your domain controllers, run:

w32tm /config /update /syncfromflags:manual /manualpeerlist:pool.ntp.org /reliable:yes
net stop w32time & net start w32time

For VMs, disable host time sync in the hypervisor settings. Let the guest sync directly with the domain. On Hyper-V, run this on the host:
```
Get-VM -Name "YourPrintServer" | Set-VM -TimeSync $false
```
Set up a scheduled task to run w32tm /resync every 4 hours. This is overkill for most environments, but I've got one client with a flaky UPS that needs it.

That's it. You shouldn't see this error again. If you do, check if someone changed the domain controller's time manually — that'll break everything until the next sync cycle.