According to this page:
Be aware that the Network Time Protocol (NTP) is unauthenticated, and unencrypted, and it is possible for an intruder to spoof the time root source, causing the wrong time to be set on the DC.
Now according to an article on configuring time servers for DCs, loss of service can be caused when the time on a DC changes:
Active Directory can't work correctly (or at all) if the clock is not synchronized around domain controllers/member machines.
For example, in Kerberos V5, computers that are more than 5 minutes out of sync will not authenticate (which is configurable by GPO: Maximum tolerance for computer clock synchronization in Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy).
Another example is replication, Active Directory uses time stamps to resolve replication conflicts.
Say an attacker is sitting on a network and for whatever reason decides to spoof the NTP traffic and cause a DOS attack. Potentially, users could not access some databases, log into their machines, and a variety of other things could occur. Are there any checks in place for such a thing, or does the server assume that the sysadmin is using IPsec / other security measures, as suggested by the first article? Would some things break instantly, such as databases, while Kerberos or AD tombstones would take a while to cause problems?
I'm pretty new to messing with domains at all, this was just something I wondered about while fixing a time problem on a network.