A security timeline breaks because one branch router's clock is 11 minutes off

The security team is investigating a suspicious login. They line up firewall logs, Active Directory logs and syslog from branch router R5, and R5's events are about 11 minutes ahead of everything else. In July the old time server 10.0.0.122 was retired and replaced by NTP1, a GPS appliance at 10.0.0.123. A template push updated the ntp server line on every router. Branch router R4, built from the standard template, has the right time.