Windows Event ID 11708 – Microsoft-Windows-Kernel-General: System Time Change Detected

Start by examining the specific details of Event ID 11708 to understand the nature of the time change.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 11708 in the Event IDs field and click OK
5. Double-click on recent Event ID 11708 entries to view detailed information
6. Examine the General tab for old time, new time, and process information
7. Check the Details tab for additional XML data including user SID and process details

Use PowerShell for more efficient filtering:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=11708} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Verify the Windows Time service configuration to determine if time changes are expected synchronization events.

1. Open an elevated Command Prompt or PowerShell session
2. Check the current time service configuration:

w32tm /query /configuration

3. Verify the time source and synchronization status:

w32tm /query /source
w32tm /query /status

4. Review time service event logs for additional context:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Time-Service'} -MaxEvents 10

5. For domain-joined computers, verify domain controller time synchronization:

w32tm /monitor /domain

Determine which process and user account initiated the time change to identify potential security concerns.

1. Extract detailed event information using PowerShell:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=11708} -MaxEvents 5
foreach ($Event in $Events) {
    $XML = [xml]$Event.ToXml()
    $EventData = $XML.Event.EventData.Data
    Write-Host "Time: $($Event.TimeCreated)"
    Write-Host "Process ID: $($EventData | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text')"
    Write-Host "User SID: $($EventData | Where-Object {$_.Name -eq 'UserSid'} | Select-Object -ExpandProperty '#text')"
    Write-Host "Old Time: $($EventData | Where-Object {$_.Name -eq 'OldTime'} | Select-Object -ExpandProperty '#text')"
    Write-Host "New Time: $($EventData | Where-Object {$_.Name -eq 'NewTime'} | Select-Object -ExpandProperty '#text')"
    Write-Host "---"
}

2. Cross-reference the Process ID with running processes at the time:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -like "*ProcessId*"} | Select-Object TimeCreated, Message

3. Resolve the User SID to identify the account:

$SID = "S-1-5-21-..." # Replace with actual SID from event
(New-Object System.Security.Principal.SecurityIdentifier($SID)).Translate([System.Security.Principal.NTAccount])

Implement comprehensive monitoring to track future time changes and establish baseline behavior.

1. Enable advanced audit policies for time changes:

auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable

2. Create a scheduled task to monitor Event ID 11708:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-WinEvent -FilterHashtable @{LogName='System'; Id=11708} -MaxEvents 1 | Out-File C:\Logs\TimeChanges.log -Append"
$Trigger = New-ScheduledTaskTrigger -AtStartup
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "MonitorTimeChanges" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

3. Set up Event Viewer custom views for time-related events:

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[(EventID=11708 or EventID=1074 or EventID=6005 or EventID=6006)]]</Select>
  </Query>
</QueryList>

4. Configure Group Policy to restrict time change permissions if needed:

Navigate to Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment → Change the system time

Perform comprehensive analysis to correlate time changes with other system events for security investigations.

1. Create a PowerShell script for comprehensive time change analysis:

$StartTime = (Get-Date).AddDays(-7)
$TimeChangeEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=11708; StartTime=$StartTime}
$SecurityEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=@(4624,4625,4648,4672); StartTime=$StartTime}

foreach ($TimeEvent in $TimeChangeEvents) {
    $TimeWindow = $TimeEvent.TimeCreated
    $CorrelatedEvents = $SecurityEvents | Where-Object {
        $_.TimeCreated -ge $TimeWindow.AddMinutes(-5) -and 
        $_.TimeCreated -le $TimeWindow.AddMinutes(5)
    }
    
    Write-Host "Time Change Event: $($TimeEvent.TimeCreated)"
    Write-Host "Correlated Security Events:"
    $CorrelatedEvents | Format-Table TimeCreated, Id, LevelDisplayName -AutoSize
    Write-Host "---"
}

2. Export comprehensive event data for external analysis:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=11708; StartTime=(Get-Date).AddDays(-30)}
$Events | Select-Object TimeCreated, Id, LevelDisplayName, @{Name='ProcessId';Expression={([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text'}}, @{Name='UserSid';Expression={([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'UserSid'} | Select-Object -ExpandProperty '#text'}} | Export-Csv -Path "C:\Temp\TimeChangeAnalysis.csv" -NoTypeInformation

3. Check for registry modifications related to time settings:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} | Where-Object {$_.Message -like "*CurrentControlSet\Control\TimeZoneInformation*" -or $_.Message -like "*W32Time*"}

4. Analyze system performance counters for time-related metrics:

Get-Counter "\System\System Up Time" -MaxSamples 1
Get-Counter "\W32Time Service\Clock Frequency Adjustment (ppb)" -MaxSamples 5 -SampleInterval 2