Windows Server / Time Synchronization

This, of course, assumes A.) You want to do it this way (overengineering a solution that goes contradictory to the documentation - the downfall of MANY a microsoft shop who think they "know better" in all of their product lineup) instead of the way AD is designed to operate and B.) that all your DCs have internet access of some kind (they shouldn't). ​ For AD time, there really is only one correct way to do it by the book. ​ And in a multi-domain forest scenario, everything should be domheir except for the forest root domain PDC, which is the time sync source. And you need \*five\* NTP sources configured for best accuracy (this is part of NTP spec - throws out the two furthest out and averages the remaining three). ​ A config like that for someone coming in who's expecting a by the book (or none at all) configuration would be thrown for a loop troubleshooting something like that, much less anyone else who might be involved or come across that environment. ​ This handy guide I usually point people to even shows you how to set up a filtering GPO (and configure domain time in general correctly) to track with the PDC emulator role, so if you have to seize roles from a failed domain controller the time configuration follows and sets itself properly after you do so without any additional work: [https://learn.microsoft.com/en-us/archive/blogs/nepapfe/its-simple-time-configuration-in-active-directory](https://learn.microsoft.com/en-us/archive/blogs/nepapfe/its-simple-time-configuration-in-active-directory) ​ At any one point in time, by design and by the book, there should only ever be \*one\* DC ever doing external time sync, and everything else flows down from that.