1. Redhat's default ntpd.conf configuration is pure shit. Don't use it. Don't even think about basing your config on it. Notably, remove the "server 127.127...." and fudge lines.

2. You're Windows NT time server is essentially a "tier 2" server. That server (and its mirror/failover) really sohuld be the only "server" lines you need here.

3. You're "restrict" lines may be in fact restricting your server from being modified by the time servers you want to in fact synchronize to. That's how you've set your default, and then you are permissive only with the localhost. So that wouldn't work.

4. If your server is not behnid a firewall which blocks incoming NTP from unknown servers, having the authentication enabled would be a smart idea. Having said that, it might be easier to config the firewall than to figure out ntp's very confusing authentication scheme.