Glad to hear it helps and that things are working more normal now.
I would have thought every workstation would have resolved its network time to NS1
The windows time service does not work that way. It would present a risky situation if there were no alternatives. Below is the basics of how it should work.
- All domain members should use NT5DS domain time.
- Desktops and member servers sync with ANY domain controller.
- Domain controllers sync with PDC emulator (one per domain)
- PDC emulator in child domain can sync with any domain controller in parent domain.
- PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.
There's also a graphic representation of how it works in the link here.
https://blogs.technet.microsoft.com/nepapfe/2013/03/01/its-simple-time-configuration-in-active-directory
--please don't forget to Accept as answer if the reply is helpful--