Way to determine how often Chrony is querying NTP servers to sync time

Using NTP intermittently (even as often as once per minute) is not going to help a lot. NTP is designed for constant updates/tweaks and is not intended for discrete clock jumps.

If you install a proper NTP daemon you will have better luck. I have found http://www.meinberg.de/english/sw/ntp.htm (a Windows build of the "standard" NTPd implementation) to be reliable in VMs running Windows Server 2003 and 2008.

Four things to note though:

1. Make sure the VMWare time sync methods or turned off for the guests NTP is running, or they and NTP will fight each other. The installer for the NTP build linked above will turn off common time sync software found in the guest, but it can not turn of VMWare's so you'll need to do that yourself.

2. Make sure you have tinker panic 0 specified at the top of your NTPd config file. This stops the NTP service giving up if there is a sudden change in clock drift, which is not uncommon in VMs due to differing loads on the host over time.

3. Use a local time source for the VMs for better local accuracy, and sync this local source with .pool.ntp.org or similar instead of syncing the VMs directly with the outside world. That way if your external network access goes down the VMs still have a clock source more reliable than there own to sync with (and you are being kinder to the public time servers). You could use the VMWare host machine as this local time source, though I tend to have a machine acting as external network gateway and have it perform this job also.

4. Make sure that you don't have the VM's local clock listed as a time source, even as a last-resort fall-back.

The policy you have listed should only be applied to the PDC. In fact, since only one server in your domain is the PDC, I don't even recommend using this GP setting, but instead, set it in the registry directly on the PDC DC (shameless plug for my blog entry on how to do this: http://wp.me/pZ5Rx-3v). If you insist on doing this via Group Policy, be sure to target the GPO to ONLY the PDC DC (no other computers, not even other DCs). If the policy is applied to other machines, they will all act as NTP clients, contacting the NTP server directly.

By default, domain-joined clients are set to use the Windows Time Service. So, once you clear out this GPO, the domain clients should revert to Windows Time Service automatically.

As for the command in the login script, you won't need it once you clean up the GPO, so it's safe to remove. It was likely put there by the person who originally crafted the GPO, since they couldn't figure out how to get the clients to use the PDC for time...