Run DCDIAG on the domain controller and confirm it is advertising as a time server. You may also get the time server advertising status with the NLTEST command:
nltest.exe /server:dcname /dsgetdc:acmecorp.com
DC: \\dcname.acmecorp.com
Address: \\n.n.n.n
Dom Guid: 5fb09a11-8148-4d9c-a53a-d7a218880eaf
Dom Name: acmecorp.com
Forest Name: acmecorp.com
Dc Site Name: Blah
Our Site Name: Blah
Flags: GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS
^^^^^^^^
You may use the w32tm.exe command on the client to determine why the time sync is not occurring.
A modern (non-legacy) windows client typically has output similar to below:
>w32tm /query /status /verbose
Leap Indicator: 0(no warning)
Stratum: 4 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0937500s
Root Dispersion: 1.0042565s
ReferenceId: 0xDEADBEEF (source IP: n.n.n.n) <-- Should be the Domain Controller
Last Successful Sync Time: 10/24/2012 8:25:56 AM
Source: DCName.acmecorp.com <-- Should be the Domain Controller
Poll Interval: 11 (2048s)
Phase Offset: 0.1063193s
ClockRate: 0.0156005s
State Machine: 1 (Hold)
Time Source Flags: 2 (Authenticated )
Server Role: 0 (None)
Last Sync Error: 0 (The command completed successfully.)
Time since Last Good Sync Time: 24.4367708s
If the DC is not advertising as a time server, but everything seems correct, sometimes manually adjusting the registry value would correct the issue. When a DC is advertising as a time server, the following "Enabled" registry value will be 1. If this is 0, it definitely will not provide time services to your workstations.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\NtpServer]
"Enabled"=dword:00000001