Shane is right about the time skew, it is probably not your issue; the default setting is 5 minutes tolerance btw.
When talking about time-outs, be aware that the time-out value for a Kerberos v5 authentication operation is 30 seconds. This can be adjusted by the KdcWaitTime
value in the following key on the Domain Controller:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters]
Another issue (although uncommon in small and mid-sized forests), is the default token size limitation of 12 kilobytes. If the users token size exceeds 12K, you might also run into problems. Read more about the token size issue here
This is guesswork however, as your question doesn't really bring any valuable diagnostic information to the table