Check Windows time against AD or target

On Windows servers, I believe the nsclient.ini is now renamed to NSC.ini on newer nagios XI agent installations.
Change is under the "C:Program FilesNSClient++scripts" section and it should be;
"-Add to NSC.ini"

Also, if you haven't enabled or used NRPE checks, this is a good read with the main reminder to be that you need to restart your NSClient++ service after making changes to your NSC.ini file - https://assets.nagios.com/downloads/nagiosxi/docs/Enabling-The-NRPE-Listener-In-NSClient-0.3.x.pdf

Lastly, if you're running the latest version of Nagios XI, where the instructions say to add a new command, I had to replace the -n with a -2 or else I would get version errors. ie.
$USER1$/check_nrpe -H $HOSTADDRESS$ -2 -c check_time -a "$ARG1$" $ARG2$ $ARG3$

... but has it's shortcomings.

This is a corrected version (hopefully it doesn't get garbled):

# ====================================================================
# Check time against DC or specified server through NRPE / w32tm
# Author: Mathieu Chateau - LOTP
# mail: mathieu.chateau@lotp.fr
# version 0.1
# corrected and fixes performance data for positive differences by UKA
# ====================================================================

#
# Require Set-ExecutionPolicy RemoteSigned.. or sign this script with your PKI
#

# ============================================================
#
# Do not change anything behind that line!
#
param
(
[string]$refTimeServer,
[int]$maxWarn = 1,
[int]$maxError = 5
)

$output=""
$exitcode=2
$random=
if(($refTimeServer -eq $null) -or ($refTimeServer -eq "") -or ($refTimeServer -eq " "))
{
$refTimeServer=$env:LOGONSERVER -replace ('\\',"")
if(($refTimeServer -match "^$|^ $") -or ($env:LOGONSERVER -match $refTimeServer))
{
if((gwmi win32_computersystem).partofdomain -eq $true)
{
#Must use select and not .Name directly. If some DC are down, command will be empty with .Name
$fromAD=@()

foreach ($entry in ((([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() | % { $_.DomainControllers }))| select Name))
{
#if this server is a DC, can't check time against itself
if(! (($env:COMPUTERNAME -match $entry) -or ($entry -match $env:COMPUTERNAME)))
{
$fromAD += $entry
}
}
if($fromAD.Count -gt 1)
{
#get a random DC from AD, as no server provided and no logon server could be found
$refTimeServer=(Get-Random -InputObject $fromAD).Name
}
else
{
#only one DC, defaulting to internet
$refTimeServer="de.pool.ntp.org"
}
}
else
{
#Workgroup but no server to check time against provided. Defaulting to internet to do something
$refTimeServer="de.pool.ntp.org"
}
}
}

if(($refTimeServer -eq $null) -or ($refTimeServer -eq "") -or ($refTimeServer -eq " "))
{
#Something bad happened. Should never happen
Write-Host "CRITICAL: can't auto detect logon server to check against. Need to specify manually using refTimeServer argument"
exit 2
}

# determine time offset to selected server
$temp=w32tm /stripchart /computer:$refTimeServer /period:1 /dataonly /samples:1
# get last line: time, [+-]00.00000 -> replace 00 by 0, replace +0 by + (for performance data)
$temp=($temp | select -Last 1) -replace (".*, ","") -replace ("\+0","0") -replace ("00\.","0.")
$temp=$temp -replace ("s$","")

# default
$state = "WARNING"

if ($temp -match "^\-?[0-9]+\.[0-9]+$")
{
$output=$temp+"s - checked against "+$refTimeServer
if ([math]::abs($temp) -gt $maxError)
{
$state="CRITICAL"
$exitcode=2
}
elseif ([math]::abs($temp) -gt $maxWarn)
{
$state="WARNING"
$exitcode=1
}
else
{
$state="OK"
$exitcode=0
}
}
else
{
$output="Error: - used $refTimeServer as time server - output:$temp"
$exitcode=2
}

$output=$state+":"+$output+'|'+"offset="+$temp+"s"+";"+$maxWarn+";"+$maxError+";"
Write-Host $output
exit $exitcode