When performing certificate based kerberos authentication (PKINIT) with compatibility This parameter specifies the number of minutes that a certificate's issue date may precede the creation of a user's account. More details can be found at KB5014754: Certificate-based authentication changes on Windows domain controllers 0