A deployable Splunk app that captures the Drift between the target server and your NTP source.
Windows only.
Comes with example syntax for graphing results or raising an alert/report sent via email
Tested on Splunk 4.3 (untested on other versions at this time)
Tested on server endpoints running: Windows 2003R2, Windows 2008R2