What is the problem with preventing time changes in the 2012r2 domain?

Question

Windows Server

I establish the new domain in the new wood. Everything is from scratch, everything is new.
After adding a computer to the domain, it is impossible to log into the computer, it swears that the time is not synchronized with the domain. And you can not log in either under the local account or under the account of the domain administrator. Time and time zones are synchronized. On some computers, you can log in under the account of the domain administrator and after that you can already log in to the user, but on some it does not let you in at all under anyone. You can only enter in safe mode.
If you still manage to enter, then no one can change the time at all. Under the user account, it is understandable, but it does not allow even the domain administrator to change it.
Yes, perhaps the problem is in the security settings, but everything was set from scratch, no default policies were changed. On computers of XP users.
Actually the question is how to overcome? And why can't you even log in as a local admin?
upd. Domain in virtual machine. 2012r2, hyper-v.
upd. The problem is only with XP. 7 and above connect without problems.
The problem turned out to be the wrong date on the domain controller. The question why it was impossible to log in even under the local administrator and the domain administrator remains open.

Answer 1

When the CD is virtualized:
- In the virtual machine settings, it must be specified that the virtual machine always starts.
- Time synchronization must be disabled (the host must not set the time on a virtual machine with the role of a domain controller)
- The domain controller must be synchronized with an external NTP server. In a virtual environment, timer corrections do not affect server physics.