Univention UCS would be a sweet “Domain-Controller in a box” solution if there weren’t that many pitfalls like setting the NTP server correctly. That stuff is done via “ucr”, some univention tool on commandline or hidden in their registry.

ucr set timeserver=”pool.ntp.org”

It’s just as simple as that to stop the ActiveDirectory from acting up…