If your not allowing NTP traffic outside of your "trusted perimeter" then its not really an issue.
your risk assessment will most likely mitigate the attack chances via internal security mechanisms.
i.e. only authorised personal on-site, only approved equipment allowed to connect to lan.
Time is critical in the AD domain and its just not worth the risk trying to be too paranoid about it.
Time needs to get to all servers and within the AD structure the client machines.
It's the clients that can be the tricky bit.
I'm assuming your clients and some servers in a distributed environment are all over the place.
Davie
P.S there is a decent article on Windows Time Service at technet
http://technet2.microsoft.com/Window...0c0181033.mspx