That one by itself may not be a problem. Look for other Time-Service 35, 37 events. Assuming the members all got the domain firewall profile you shouldn't need to fiddle with firewall.
Some general info
- All domain members should use NT5DS domain time.
- Desktops and member servers sync with any domain controller.
- Domain controllers sync with PDC emulator (one per domain)
- PDC emulator in child domain can sync with any domain controller in parent domain.
- PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.
https://blogs.technet.microsoft.com/nepapfe/2013/03/01/its-simple-time-configuration-in-active-directory/
--please don't forget to upvote
and Accept as answer
if the reply is helpful--
Thanks for information @Dave Patrick
You're welcome.