Use GPO with a WMI Filter to force the PDC emulator to be the authoritative time source.
SELECT DomainRole FROM Win32_ComputerSystem WHERE DomainRole = 5
| Domain Role | Number |
|---|---|
| Standalone Workstation | 0 |
| Member Workstation | 1 |
| Standalone Server | 2 |
| Member Server | 3 |
| Backup Domain Controller | 4 |
| Primary Domain Controller | 5 |
References: