Windows – Can time skew on Windows be reduced to +/- 5ms

The fix is to disable Time Synchronization in the Hyper-V Integration Services for each guest. Then restart the Windows Time serviceon the guest. The guests will then correctly synchronize with a domain controller.

This process is crucial on virtualized domain controllers as they are providing time to all clients. Remember that the domain controller with the PDC emulator role should be configued with external NTP time sources (configured using the w32tm command line).

Information on configuring external NTP time sources for Windows Time is available in this answer.

I'll agree with sysadmin1138 on the first 2 sentences in his answer:

That's not how NTP works, presuming a full NTP client. NTP works by disciplining the local clock so it can't fall out of sync, rather than hard-setting it back to true.

The rest, while true, is quite unnecessary.

All domain controllers are NTP servers by default. The DC which holds the "PDC Emulator" FSMO role should be configured to sync with an Internet NTP server, preferably a stratum 2 server. All other DCs will automagically sync themselves with that DC.

All domain members will automagically sync with their closest DC.

With the exception of the configuration of the PDC Emulator DC, all of this happens with no manual configuration required. There's really no need to mess with it under normal circumstances.

If you have non-Windows machines in your environment, you can simply configure them to use your AD domain name as an NTP server (assuming they are using the same DNS servers as your domain member machines), since the DNS A record for the AD domain name always resolves to all DC IP addresses.