According to Symantec, there was an abrupt increase in number of NTP monlist DDoS attacks in December. The source link:
The examples in the article are obviously related to different versions of *nix servers. Is Windows Server (2003, 2008, 2012) vulnerable to this kind of attacks? The article recommends to upgrade to NTP version 4.2.7 (where the monlist command is deprecated), and, AFAIK, at least Windows Server 2008 R2 runs version 3 of NTP. And every AD domain controller runs NTP service by default...