* Time service. This way there is no need to set up any SNTP and the router is always in sync with the hosts.
Off topic, just wanted to make a quick comment on this one: most hypervisors are pretty tough on the internal clock. We've found our Hyper-V servers (and ESX before them) tended to drift around a bit depending on system load. Our environment (SCADA) is very sensitive to clock clock changes. We disabled timesync on all of our VMs (easy to do in bulk via powershell):
Disable-VMIntegrationService -name 'Time Synchronization' -Computername HYPERVHOST -Vmname *
and then plonked this registry entry on our guest VMs so they could sync directly against our timesource via NTP/SNTP.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\Parameters]
"Type"="NTP"
"NtpServer"="ntpserver.domain,0x1"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\Config]
"AnnounceFlags"=dword:00000005
"MaxNegPhaseCorrection"=dword:00000708
"MaxPosPhaseCorrection"=dword:00000708
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\NtpServer]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\NtpClient]
"SpecialPollInterval"=dword:0000012c