Windows Event ID 4950 – Microsoft-Windows-Kernel-General: System Time Changed

Start by examining the specific details of Event ID 4950 to understand the nature of the time change.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4950 in the Event IDs field and click OK
5. Double-click on recent Event ID 4950 entries to view detailed information
6. Examine the General tab for old time, new time, and time difference
7. Check the Details tab for process ID and additional context

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=4950} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Investigate the Windows Time service configuration to determine if time changes are expected behavior.

1. Open an elevated Command Prompt or PowerShell
2. Check the current time service configuration:

w32tm /query /configuration

3. Verify the time source being used:

w32tm /query /source

4. Check the time service status:

w32tm /query /status

5. Review time synchronization peers:

w32tm /query /peers

6. For domain-joined computers, verify domain hierarchy:

w32tm /query /configuration | Select-String -Pattern 'Type|NtpServer'

7. Check the Windows Time service event log:

Get-WinEvent -LogName 'Microsoft-Windows-Time-Service/Operational' -MaxEvents 50

Cross-reference Event ID 4950 with other system events to identify the root cause and impact of time changes.

1. Check for related security events around the same timeframe:

$timeChange = Get-WinEvent -FilterHashtable @{LogName='System'; Id=4950} -MaxEvents 1
$startTime = $timeChange.TimeCreated.AddMinutes(-10)
$endTime = $timeChange.TimeCreated.AddMinutes(10)
Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$startTime; EndTime=$endTime} | Where-Object {$_.Id -in @(4624,4625,4648,4672)}

2. Look for application errors that might be related to time changes:

Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=$startTime; EndTime=$endTime; Level=2}

3. Check for Kerberos authentication issues:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=@(13,40)} -MaxEvents 20

4. Review Task Scheduler events for missed or failed tasks:

Get-WinEvent -LogName 'Microsoft-Windows-TaskScheduler/Operational' -MaxEvents 50 | Where-Object {$_.TimeCreated -gt $startTime -and $_.TimeCreated -lt $endTime}

5. Create a comprehensive timeline report:

$events = @()
$events += Get-WinEvent -FilterHashtable @{LogName='System'; Id=4950; StartTime=(Get-Date).AddDays(-1)}
$events += Get-WinEvent -FilterHashtable @{LogName='System'; Id=@(13,40); StartTime=(Get-Date).AddDays(-1)}
$events | Sort-Object TimeCreated | Format-Table TimeCreated, LogName, Id, LevelDisplayName, Message -Wrap

Implement monitoring solutions to track and alert on unexpected time changes for security and compliance purposes.

1. Create a custom Event Viewer view for time change monitoring:
2. In Event Viewer, right-click Custom Views and select Create Custom View
3. Set Event level to Information, Event logs to System, and Event IDs to 4950
4. Save the view as "Time Changes Monitor"
5. Set up a scheduled task to alert on time changes:

$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-Command "Get-WinEvent -FilterHashtable @{LogName=\"System\"; Id=4950; StartTime=(Get-Date).AddMinutes(-5)} | ForEach-Object {Send-MailMessage -To admin@company.com -From timechange@company.com -Subject \"Time Change Detected\" -Body $_.Message -SmtpServer mail.company.com}"'
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365)
Register-ScheduledTask -TaskName "TimeChangeAlert" -Action $action -Trigger $trigger -Description "Alert on system time changes"

6. Configure Windows Event Forwarding for centralized monitoring:

# On the collector server
wecutil qc
# Create subscription for Event ID 4950
wecutil cs TimeChangeSubscription.xml

7. Use PowerShell to create a real-time monitor:

Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent" -Action {
    $event = Get-WinEvent -FilterHashtable @{LogName='System'; Id=4950} -MaxEvents 1
    Write-Host "Time change detected at $($event.TimeCreated): $($event.Message)"
}

Perform deep forensic analysis to understand the source and impact of time changes, especially in security incident investigations.

1. Export Event ID 4950 events for detailed analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=4950; StartTime=(Get-Date).AddDays(-30)} | Export-Csv -Path "C:\Temp\TimeChanges.csv" -NoTypeInformation

2. Examine registry keys related to time synchronization:

# Check time service configuration
Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters"
# Review time providers
Get-ChildItem -Path "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders" -Recurse

3. Analyze process information from event details:

$events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=4950} -MaxEvents 10
foreach ($event in $events) {
    $xml = [xml]$event.ToXml()
    $processId = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text'
    if ($processId) {
        Write-Host "Time change by Process ID: $processId at $($event.TimeCreated)"
    }
}

4. Check for suspicious time patterns using statistical analysis:

$timeChanges = Get-WinEvent -FilterHashtable @{LogName='System'; Id=4950; StartTime=(Get-Date).AddDays(-7)}
$intervals = @()
for ($i = 1; $i -lt $timeChanges.Count; $i++) {
    $interval = ($timeChanges[$i-1].TimeCreated - $timeChanges[$i].TimeCreated).TotalMinutes
    $intervals += $interval
}
$avgInterval = ($intervals | Measure-Object -Average).Average
Write-Host "Average time between changes: $avgInterval minutes"
$intervals | Group-Object | Sort-Object Count -Descending

5. Generate a comprehensive forensic report:

$report = @"
Time Change Forensic Report - Generated: $(Get-Date)
=================================================

Recent Time Changes:
"@
$events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=4950} -MaxEvents 20
foreach ($event in $events) {
    $report += "`n$($event.TimeCreated): $($event.Message)"
}
$report += "`n`nTime Service Status:`n"
$report += w32tm /query /status
$report | Out-File -FilePath "C:\Temp\TimeChangeReport.txt"