https://docs.microsoft.com/en-US/troubleshoot/windows-server/identity/configure-authoritative-time-server for step 3, the DC is configured to be an NTP server and is serving UDP 123. ntpq times out but ntpdate will succeed.
ntpq uses NTP control messages, which will not work on AD DS domain controllers. Some people further restrict the control protocol to localhost only, even between hosts running ntpd.
Query the client's ntpd by sending localhost a peers command: ntpq -p
Make a one-time adjustment with ntpd -g -q or by restarting ntpd
Other implementations, chrony, BusyBox ntpd, have different interfaces.
