Hi folks, some ipa servers in my environment are not permitted to change the clock. If I use "systemctl mask ntpd" to avoid the "degraded" returned by "systemctl status", then ipactl fails without the ntpd service: # ipactl restart Stopping pki-tomcatd Service Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting httpd Service Restarting ipa-custodia Service Restarting pki-tomcatd Service Restarting ipa-otpd Service Starting ntpd Service Failed to start ntpd Service Shutting down Hint: You can use --ignore-service-failure option for forced start in case that a non-critical service failed Aborting ipactl If I unmask ntpd, then systemctl status returns "degrarded" again, but ipa is fine. The option "--ignore-service-failures" ignores *all* service failures. I wonder how I can tell freeipa to ignore ntpd and rely upon sysvinit or systemd to start it, if necessary? Every helpful comment is highly appreciated. Harri