Hyper-V – How to Sync Time of a Domain Member Host

The policy you have listed should only be applied to the PDC. In fact, since only one server in your domain is the PDC, I don't even recommend using this GP setting, but instead, set it in the registry directly on the PDC DC (shameless plug for my blog entry on how to do this: http://wp.me/pZ5Rx-3v). If you insist on doing this via Group Policy, be sure to target the GPO to ONLY the PDC DC (no other computers, not even other DCs). If the policy is applied to other machines, they will all act as NTP clients, contacting the NTP server directly.

By default, domain-joined clients are set to use the Windows Time Service. So, once you clear out this GPO, the domain clients should revert to Windows Time Service automatically.

As for the command in the login script, you won't need it once you clean up the GPO, so it's safe to remove. It was likely put there by the person who originally crafted the GPO, since they couldn't figure out how to get the clients to use the PDC for time...

The best practice for time sync on Hyper-V is:

For Domain Controllers: Disable Hyper-V time sync inside the guest, but leave Hyper-V time sync enabled on the virtual machine configuration in the Hyper-V management console. This way Hyper-V sets the clock when the guest boots or resumes from a pause, but during normal operation the guest is responsible for its own clock. Use this command on the guest to stop it from using VM IC:

reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider /v Enabled /t reg_dword /d 0

(For a domain controller, it is important that it be responsible for its own time sync because AD needs to know the quality of the time. If the guest is managing the clock, it has access to the quality indicator of the network time. But if Hyper-V is managing the clock, then the guest sees the clock as an authoritative clock and always assumes it's correct, even when it's not.)

For all other guests: Use the Hyper-V guest additions to sync the clock. If the guest does not have additions installed then use the hardware clock, which the Hyper-V hypervisor will emulate.

Since in your case you've monkeyed with the time sync settings on your DC guests, I suggest that you reset your w32time settings first, then reinstall the guest additions, and finally apply the registry setting above.