Domain clients time out of sync

As the Samba AD runs in a nspawn container it uses the host time, see Domain Controller time clock out of sync - #6 by davidep