fix(validation): remove residual NTP references from scripts and docs

Cleans up stale NTP prompt, config override, synopsis comment, and
doc rows left after the Cat-3 NTP cut. time.windows.com in
endpoints.json is retained — it is a valid Azure Local firewall
endpoint (OS time sync), not a Beacon pre-OS check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013AZySkzowyq4Ne2hrSRRAL

Author: kristopherjturner

README.md

@@ -52,7 +52,7 @@ Or download the full driver pack for your hardware and point `-DriverPath` at th
 
 ### 1. Populate config
 
-Copy `src/config/validation-config.example.json` to `src/config/validation-config.json` and fill in your deployment values (DNS, NTP, AD domain, node IPs, gateway, IP pool range).
+Copy `src/config/validation-config.example.json` to `src/config/validation-config.json` and fill in your deployment values (DNS, AD domain, node IPs, gateway).
 
 Regenerate the Azure endpoint list if needed:
 

docs/validation/active-directory.md

@@ -10,7 +10,6 @@ Select **option 1** from the Beacon main menu to validate readiness for an AD-jo
 | Domain controller IP(s) | `10.10.0.10, 10.10.0.11` | Yes |
 | Target OU Distinguished Name | `OU=AzureLocal,DC=corp,DC=improbability,DC=cloud` | Optional |
 | Deployment prefix (≤ 8 chars) | `azl` | Optional (default: `azl`) |
-| Primary NTP/time source | `10.10.0.1` | Optional (default: `time.windows.com`) |
 
 ## Tests run
 

docs/validation/network-firewall.md

@@ -8,7 +8,7 @@ This path runs everything except the AD port tests (Category 4). It's ideal for:
 
 - Verifying firewall policy before any identity configuration
 - Checking endpoint reachability from the management VLAN
-- Confirming DNS and NTP are reachable
+- Confirming DNS is reachable
 
 ## What you are prompted for
 

src/Build-WinPEImage.ps1

@@ -27,7 +27,7 @@
     The image is stage 1 of the 5-stage Azure Local validation lifecycle. See
     docs/index.md for the full coverage matrix.
 
-    All environment values (DNS, NTP, domain, node IPs) are supplied via the config folder
+    All environment values (DNS, domain, node IPs) are supplied via the config folder
     copied into the image -- no values are hardcoded in this script.
 
 .PARAMETER WorkspacePath

src/Start-AzlBeacon.ps1

@@ -201,20 +201,15 @@ function Invoke-ADMenu {
     $ouDn          = Prompt-Optional 'Target OU Distinguished Name (e.g. OU=AzureLocal,DC=corp,DC=contoso,DC=com)'
     $deployPrefix  = Prompt-Optional 'Deployment prefix (up to 8 chars)' -Default 'azl'
     Write-BeaconLine ''
-    $ntpPrimary    = Prompt-Optional 'Primary NTP/time source IP or FQDN' -Default 'time.windows.com'
-
     Write-BeaconLine ''
     Write-BeaconLine '  Configuration collected. Updating validation config...' -Color Cyan
 
     $overrides = @{
-        adDomainFqdn          = $domainFqdn
-        dcIps                 = $dcIps
-        deploymentPrefix      = $deployPrefix
-    }
-    if ($ouDn)      { $overrides['adOuDn']   = $ouDn }
-    if ($ntpPrimary) {
-        $overrides['ntpServers'] = @{ primary = $ntpPrimary; secondary = 'time.windows.com' }
+        adDomainFqdn     = $domainFqdn
+        dcIps            = $dcIps
+        deploymentPrefix = $deployPrefix
     }
+    if ($ouDn) { $overrides['adOuDn'] = $ouDn }
     Write-ValidationConfigOverrides -Overrides $overrides
 
     Write-BeaconLine ''
@@ -298,7 +293,7 @@ function Invoke-LocalIdentityMenu {
 function Invoke-NetworkFirewallMenu {
     Write-BeaconHeader 'Networking and Firewall Validation'
     Write-BeaconLine '  Validates physical network, endpoint reachability (Azure Local + Arc + Dell),' -Color White
-    Write-BeaconLine '  DNS, NTP, and the Microsoft Environment Checker.' -Color White
+    Write-BeaconLine '  DNS and the Microsoft Environment Checker.' -Color White
     Write-BeaconLine ''
 
     $gwIp       = Prompt-Optional 'Management gateway IP (leave blank to use DHCP-detected)'

src/Start-AzlValidation.ps1

@@ -65,8 +65,7 @@
     Prerequisites:
       - config\validation-config.json and config\endpoints.json must exist.
       - curl.exe must be on PATH for HTTPS GET probes (built-in to WinPE and Win10+).
-      - w32tm.exe must be on PATH for NTP checks (built-in to WinPE).
-      - AzStackHci.EnvironmentChecker required for Cat-6/7 (bundled at ISO build time).
+      - AzStackHci.EnvironmentChecker required for Cat-5/6 (bundled at ISO build time).
     PSScriptAnalyzer: passes at Warning/Error severity.
     Compatibility: PowerShell 5.1 (WinPE) and PowerShell 7. No PS7-only syntax used.
 #>