#time-synchronization

Windows Event ID 11708 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 11708 indicates the system time was changed, either manually by a user or automatically by time synchronization services. Critical for security auditing and troubleshooting time-related issues.

Windows Event ID 5889 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 5889 indicates the system time was changed, either manually by a user or automatically by time synchronization services. This event helps track time modifications for security and audit purposes.

Windows Event ID 5121 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 5121 fires when Windows detects a system time change, either manual adjustment or automatic synchronization. Critical for security auditing and troubleshooting time-related issues.

Windows Event ID 4950 – Microsoft-Windows-Kernel-General: System Time Changed

Event ID 4950 fires when the system time is changed on a Windows machine, either manually by a user or automatically by time synchronization services.

Windows Event ID 4892 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 4892 fires when Windows detects a system time change, typically during time synchronization, manual adjustments, or hardware clock drift corrections.

Windows Event ID 4616 – Security: System Time Changed

Event ID 4616 logs when the system time is changed on a Windows machine. This security audit event tracks time modifications for compliance and forensic purposes.

Windows Event ID 16388 – Microsoft-Windows-Kernel-General: System Time Change Notification

Event ID 16388 fires when Windows detects a system time change, either manual adjustment or automatic synchronization. Critical for security auditing and troubleshooting time-related issues.

Windows Event ID 16384 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 16384 fires when Windows detects a system time change, either manual or automatic. Critical for security auditing and troubleshooting time synchronization issues in domain environments.

Windows Event ID 11728 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 11728 fires when Windows detects a system time change, typically from time synchronization services, manual adjustments, or hardware clock drift corrections.

Windows Event ID 11724 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 11724 indicates the Windows kernel detected a system time change, typically triggered by time synchronization services, manual adjustments, or hardware clock drift corrections.

Windows Event ID 8301 – Microsoft-Windows-Kernel-General: System Time Change Notification

Event ID 8301 fires when Windows detects a system time change, either manual adjustment or automatic synchronization. Critical for security auditing and troubleshooting time-related issues.

Windows Event ID 4097 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 4097 fires when Windows detects a system time change, either manual or automatic. Critical for security auditing and troubleshooting time synchronization issues.