You want the PDC Emulator in the root domain to be using NTP and all other DCs to be using NT5DS to sync time. As long as everything is within 5 minutes of each other Kerberos (within the forest realm ...
XP has its own ntp time client type facility. For Win2k, Im not aware of such a feature. maybe someone can recommend some reliable 3rd party program.