Windows Event ID 5121 – Microsoft-Windows-Kernel-General: System Time Change Detected

Start by examining the specific details of Event ID 5121 to understand what triggered the time change.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 5121 in the Event IDs field and click OK
5. Double-click on recent Event ID 5121 entries to view detailed information
6. Review the General tab for OldTime, NewTime, and Reason fields
7. Check the Details tab for additional context including Process ID

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=5121} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Investigate the Windows Time Service configuration and synchronization status to identify potential issues.

1. Open an elevated Command Prompt or PowerShell session
2. Check current time synchronization status:

w32tm /query /status

3. Review time source configuration:

w32tm /query /source

4. Examine detailed time service configuration:

w32tm /query /configuration

5. Check for recent time synchronization events:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Time-Service'} -MaxEvents 10

6. Verify NTP server connectivity if using external time sources:

w32tm /stripchart /computer:pool.ntp.org /samples:5

Identify which processes are modifying system time and determine if the changes are authorized.

1. Use PowerShell to extract detailed event information including process details:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=5121} -MaxEvents 50
foreach ($Event in $Events) {
    $XML = [xml]$Event.ToXml()
    $ProcessId = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text'
    $OldTime = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'OldTime'} | Select-Object -ExpandProperty '#text'
    $NewTime = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'NewTime'} | Select-Object -ExpandProperty '#text'
    Write-Output "Time: $($Event.TimeCreated) | Process ID: $ProcessId | Old: $OldTime | New: $NewTime"
}

2. Cross-reference process IDs with running processes at the time of the event
3. Check for suspicious applications that might be manipulating system time:

Get-Process | Where-Object {$_.ProcessName -match 'time|clock|sync'} | Select-Object ProcessName, Id, StartTime, Path

4. Review installed software for time-related utilities:

Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -match 'time|clock|sync'} | Select-Object Name, Version, InstallDate

5. Examine scheduled tasks that might modify system time:

Get-ScheduledTask | Where-Object {$_.Actions.Execute -match 'w32tm|time|clock'} | Select-Object TaskName, State, Actions

Implement comprehensive monitoring to track and alert on unauthorized time changes.

1. Enable advanced audit policy for time changes using Group Policy or local security policy:
2. Open Local Security Policy (secpol.msc) or Group Policy Management
3. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
4. Expand System Audit Policies → System
5. Configure Audit Security System Extension to Success and Failure
6. Set up PowerShell monitoring script for real-time alerts:

# Create monitoring script
$Action = {
    $Event = $Event.SourceEventArgs.NewEvent
    $XML = [xml]$Event.ToXml()
    $NewTime = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'NewTime'} | Select-Object -ExpandProperty '#text'
    $OldTime = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'OldTime'} | Select-Object -ExpandProperty '#text'
    Write-Host "ALERT: System time changed from $OldTime to $NewTime" -ForegroundColor Red
    # Add email notification or logging here
}

Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent" -Action $Action

7. Configure Windows Event Forwarding to centralize time change events:

wecutil qc /q
winrm quickconfig

8. Create custom event log views for time-related events in Event Viewer

Resolve underlying time synchronization problems that may be causing frequent Event ID 5121 occurrences.

1. Reset Windows Time Service configuration to defaults:

Stop-Service w32time
w32tm /unregister
w32tm /register
Start-Service w32time

2. Configure reliable time sources for domain and workgroup environments:

# For domain controllers
w32tm /config /manualpeerlist:"pool.ntp.org,0x8 time.windows.com,0x8" /syncfromflags:manual /reliable:yes /update

# For domain members
w32tm /config /syncfromflags:domhier /update

3. Adjust time synchronization intervals to reduce frequent changes:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config" /v MaxPosPhaseCorrection /t REG_DWORD /d 3600 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config" /v MaxNegPhaseCorrection /t REG_DWORD /d 3600 /f

4. Configure time synchronization policies via Group Policy:
5. Open Group Policy Management and edit the appropriate GPO
6. Navigate to Computer Configuration → Administrative Templates → System → Windows Time Service
7. Configure time providers and synchronization settings
8. Force immediate time synchronization and verify results:

w32tm /resync /force
w32tm /query /status

8. Monitor hardware clock drift on physical systems:

w32tm /monitor /computers:localhost