We noticed that our workstations were about three off, and when I inspected our PDC FSMO Role Holder, I noticed that it was getting its time from the Hyper-V host, instead of time.windows.com.

The command to show this is w32tm /query /source /verbose

The VM IC Time Synchronization Provider is a feature of Hyper-V Integration components.

VM IC

Microsoft best practices are to disable this IC component on domain controllers, especially on the PDC as it should get its time from an external time source.

After disabling this within the VMM properties for the Virtual Machine, it now shows correct:

time.windows

See also: http://support.microsoft.com/kb/888794

and

http://technet.microsoft.com/en-us/library/dd348476(WS.10).aspx