I have done a lot of research but failed to find a reliable answer to our problem.
The short story is our entire Windows domain is running 35 minutes slow. I.e. servers and workstations. I think this is due to the operations master role being assigned to a Hyper-V VM. We have since moved the role over to a physical server. Unfortunately, I have inherited this from the wonderful ex-support company.
My plan (just an idea!):
Change "Maximum tolerance for computer clock synchronization" from 5 minutes to 60 minutes for the Default Domain GPO and wait a couple of hours for it to push out to the workstations? It replicates every 90 minutes by default, right?
Set an external time source on the DC with the operations master role. This should then update other servers and workstations in turn.
To ensure I am asking a straightforward question here, what is the safest and most efficient way to correct the time drift within the entire network? Obviously, immediately changing the time on the DC will cause major issues with kerberos authentication.