Cisco ASA5505 won’t sync with NTP

Today I noticed that the clock my Cisco ASA 5505 firewall was running about 15 minutes late, which surprised me since I've set up the NTP client.

My two NTP servers 10.10.0.1 and 10.10.0.2 are virtualized Windows Server 2008 R2 domain controllers, and both have the correct time.

As shown below, the ASA knows about the two servers, can ping them and seems to poll them periodically, so I suppose it can reach them both. The ASA claims its time source is NTP, however the clock is unsynchronized. Neither host is marked as synced.

Result of the command: "ping 10.10.0.1"

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms


Result of the command: "sh ntp ass"

      address         ref clock     st  when  poll reach  delay  offset    disp
 ~10.10.0.1        .LOCL.            1    78  1024  377     0.5  643.69    17.0
 ~10.10.0.2        10.10.0.1         2   190  1024  377     0.9  655.91    58.4
 * master (synced), # master (unsynced), + selected, - candidate, ~ configured


Result of the command: "sh ntp ass detail"

10.10.0.1 configured, insane, invalid, stratum 1
ref ID .LOCL., time d3932559.6aa66707 (19:58:49.416 CEDT Mon Jun 25 2012)
our mode client, peer mode server, our poll intvl 1024, peer poll intvl 1024
root delay 0.00 msec, root disp 10651.84, reach 377, sync dist 10676.743
delay 0.63 msec, offset 625.3783 msec, dispersion 24.60
precision 2**6, version 3
org time d393fc14.b4a24e74 (11:15:00.705 CEDT Tue Jun 26 2012)
rcv time d393fc14.149e12ec (11:15:00.080 CEDT Tue Jun 26 2012)
xmt time d393fc14.1474f384 (11:15:00.079 CEDT Tue Jun 26 2012)
filtdelay =     0.63    0.47    0.63    0.53    0.50    0.35    0.92    0.37
filtoffset =  625.38  629.03  635.65  643.69  644.70  646.06  644.38  642.86
filterror =    15.63   31.25   46.88   54.69   58.59   60.55   61.52   62.26

10.10.0.2 configured, insane, invalid, stratum 2
ref ID 10.10.0.1, time d393fb9b.e810a061 (11:12:59.906 CEDT Tue Jun 26 2012)
our mode client, peer mode server, our poll intvl 1024, peer poll intvl 1024
root delay 31.25 msec, root disp 10756.23, reach 377, sync dist 10796.097
delay 0.53 msec, offset 640.2991 msec, dispersion 22.28
precision 2**6, version 3
org time d393fba4.b872ee34 (11:13:08.720 CEDT Tue Jun 26 2012)
rcv time d393fba4.149a40c6 (11:13:08.080 CEDT Tue Jun 26 2012)
xmt time d393fba4.14765384 (11:13:08.079 CEDT Tue Jun 26 2012)
filtdelay =     0.53    0.64    0.85    0.87    0.61    0.81    0.53    0.73
filtoffset =  640.30  642.79  649.05  655.91  648.54  644.63  634.64  570.58
filterror =    15.63   31.25   46.88   54.69   58.59   60.55   61.52   62.30


Result of the command: "sh ntp stat"

Clock is unsynchronized, stratum 16, no reference clock
nominal freq is 99.9984 Hz, actual freq is 99.9984 Hz, precision is 2**6
reference time is 00000000.00000000 (07:28:16.000 CEST Thu Feb 7 2036)
clock offset is 0.0000 msec, root delay is 0.00 msec
root dispersion is 0.00 msec, peer dispersion is 0.00 msec


Result of the command: "sh clock detail"

10:33:23.769 CEDT Tue Jun 26 2012
Time source is NTP
UTC time is: 08:33:23 UTC Tue Jun 26 2012
Summer time starts 02:00:00 CEST Sun Mar 25 2012
Summer time ends 03:00:00 CEDT Sun Oct 28 2012

I've tried the basic steps of manually setting the time and removing and adding the timeservers, to no avail.

My ASA's ntp config is simply:

ntp server 10.10.0.1
ntp server 10.10.0.2

Do I need to enable authentication to use a Windows NTP server?

Any thoughts?