Should the AD PDC Emulator Use an External NTP Source?

Yes. The PDC Emulator should normally synchronize with one or more reliable external NTP sources, while the other domain controllers and domain members continue using the normal Active Directory time hierarchy. Use multiple peers rather than relying on a single server, and choose non-smearing sources that are appropriate for your region.

Make sure virtualization isn’t creating competing time sources. Domain controller VMs should not simultaneously sync from the hypervisor and from the AD time hierarchy; disable guest-to-host time synchronization where appropriate. If the PDC itself is virtualized, ensure the virtualization platform and its host are configured carefully so they don’t fight the NTP configuration.

A common setup is to configure the PDC Emulator with several pool.ntp.org peers or another trusted NTP service, then mark it as the reliable time source. The remaining domain controllers should sync from the PDC, and workstations should continue syncing through the domain hierarchy. Also check that UDP port 123 is allowed through firewalls and VPNs.

If your FSMO roles might move, consider using policy or automation so whichever domain controller holds the PDC Emulator role uses the external source, while the other DCs use the domain hierarchy. A one-minute difference is much larger than expected, so also verify the current PDC configuration, network access to NTP, virtualization settings, and the time source used by your phones.