Domain Controller time is 7 minutes fast

On the domain controller holding the PDC Emulator flexible single-master operations (FSMO) role in the forest root domain of your Active Directory forest should have an external-to-the-forest time source specified. On every other DC, time synchronization should be handled by the "Windows Time" service automatically. The DCs in each domain will sync with their domain's PDC Emulator role-holder, and the PDC Emulator role-holders in each domain will synchronize with the forest root PDC Emulator role-holder.

Per this document from Microsoft, be sure that you've disabled time synchronization in Host Integration Services.

Follow the procedure here to locate the DC in your domain that holds the PDC Emulator role. If you have a single-domain environment, then the PDC Emulator role-holder should have an external-to-the-forest time source configured.

Microsoft offers some more detailed guidance here, but the gist of setting an external-to-the-forest time source is using the "NET TIME" command, run on the forest root PDC Emulator role-holder, to specify the NTP server:

NET TIME /setsntp:server-name-here

Be sure that you can resolve the NTP server's name and that your firewall passes NTP (UDP port 123).

In addition to setting up SNTP/Windows Time, You also need to disable time syncronization under integration services. If you don't, you'll have conflicts as to what is setting the time, the Hyper-V Host or the Windows Time service.

Here's an article describing the process. You might also want to take a look at Ben Armstrong's article The Domain Controller Dilemma. One of the comments specifically mentions DC's under Hyper-V and time syncronization.