ntpd and S4 mystery

[Mark Rutherford]

I am rehashing this problem of never getting s4 and ntpd working.

I have the following in ntp.conf:
ntpsigndsocket /usr/local/samba/var/run/ntp_signd/
restrict default mssntp

ntpd is compiled with --enable-ntp-signd
However I don't think that ntpd is the problem.
I can see the client sending the request and the server responding to it.
The client appears to just toss it out altogether.

w32tm /resync /rediscover returns:
Sending resync command to local computer
The computer did not resync because no time data was available.

I can see the ntp daemon output:
receive: at 481 10.1.1.228<-10.1.1.15 mode 3 len 48
transmit: at 481 10.1.1.228->10.1.1.15 mode 4 len 48
(no idea what the mode means)

There is also events in the event logs such as:
"The time service has not been able to synchronize the system time for 
49152 seconds because none of the time providers has been able to 
provide a usable time stamp. The system clock is unsynchronized."

Using strace and friends I can see that ntpd never opens the socket 
that's in /usr/local/samba/var/run/ntp_signd
The socket is actually present in the directory as long as s4 is running.
My C is very rusty to the point of being almost useless in really 
debugging this and I have zero understanding of ntp.
The only thing I can verify is that the client is sending a request and 
the ntp daemon is answering it but NOT signing it.

Unfortunately this is really over my head. I have no clue as far as how 
to proceed with this.
My best guess is that all of the clients that I try send it something 
that the ntp daemon does not know what to
deal with, it sends a normal response back and the clients discard it 
because they want something else.
I have tried several virtual machines, both Windows 7 and XP and all do 
the same thing.
They join the domain just fine and function normally except for getting 
time.

How can I tell if this is a client misconfiguration or a server 
misconfiguration?
Can anyone provide some guidance on troubleshooting and debugging this?
Fresh installs in a VM doing nothing more than joining the domain also 
behave this way.
I am fresh out of ideas and things to try.