Windows Event ID 5889 – Microsoft-Windows-Kernel-General: System Time Change Detected

Start by examining the specific details of Event ID 5889 to understand what triggered the time change.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 5889 in the Event IDs field and click OK
5. Double-click on recent Event ID 5889 entries to view detailed information
6. Check the General tab for old time, new time, and process information
7. Note the time difference and whether changes appear to be automatic or manual

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=5889} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Verify the Windows Time Service configuration to determine if time changes are expected automatic synchronizations.

1. Open an elevated Command Prompt or PowerShell session
2. Check the current time service configuration:

w32tm /query /configuration

3. Review the NTP server sources and synchronization settings:

w32tm /query /source
w32tm /query /status

4. Check time synchronization logs for additional context:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Time-Service'} -MaxEvents 10

5. Verify domain time synchronization hierarchy if domain-joined:

w32tm /query /peers

6. Test manual synchronization to see if it triggers Event ID 5889:

w32tm /resync /nowait

Investigate which process or user account initiated the time change to determine if it was authorized.

1. Use PowerShell to extract detailed event information including process details:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=5889} -MaxEvents 10
foreach ($Event in $Events) {
    $EventXML = [xml]$Event.ToXml()
    Write-Host "Time: $($Event.TimeCreated)"
    Write-Host "Process: $($EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'} | Select-Object -ExpandProperty '#text')"
    Write-Host "User: $($Event.UserId)"
    Write-Host "---"
}

2. Cross-reference with Security log for logon events around the same time:

$TimeChangeEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=5889} -MaxEvents 5
foreach ($Event in $TimeChangeEvents) {
    $StartTime = $Event.TimeCreated.AddMinutes(-5)
    $EndTime = $Event.TimeCreated.AddMinutes(5)
    Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$StartTime; EndTime=$EndTime} | Select-Object TimeCreated, Id, Message
}

3. Check for scheduled tasks that might modify system time:

Get-ScheduledTask | Where-Object {$_.Actions.Execute -like '*time*' -or $_.Actions.Arguments -like '*time*'}

4. Review Group Policy settings that might affect time synchronization:

gpresult /h GPReport.html
# Review the generated HTML report for time-related policies

Implement monitoring to track future time changes and set up alerts for unauthorized modifications.

1. Create a PowerShell script to monitor Event ID 5889 in real-time:

# Save as Monitor-TimeChanges.ps1
Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2" -Action {
    $Event = Get-WinEvent -FilterHashtable @{LogName='System'; Id=5889} -MaxEvents 1
    Write-Host "Time change detected at: $($Event.TimeCreated)" -ForegroundColor Yellow
    # Add email notification or logging here
}

Write-Host "Monitoring for time changes. Press Ctrl+C to stop."
try { while ($true) { Start-Sleep 1 } }
finally { Get-EventSubscriber | Unregister-Event }

2. Set up Windows Event Forwarding to centralize time change monitoring:

# On collector server
wecutil qc
# Create subscription for Event ID 5889 from multiple systems

3. Configure audit policy to enhance time change tracking:

auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable

4. Create a custom Windows Event Log view for time changes:

# Save as TimeChangeView.xml and import into Event Viewer
<ViewerConfig>
  <QueryConfig>
    <QueryParams>
      <Simple>
        <Channel>System</Channel>
        <EventId>5889</EventId>
        <RelativeTimeInfo>0</RelativeTimeInfo>
        <BySource>False</BySource>
      </Simple>
    </QueryParams>
  </QueryConfig>
</ViewerConfig>

Perform deep analysis of time change events for security investigations or compliance requirements.

1. Export Event ID 5889 events for detailed analysis:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=5889} -MaxEvents 100
$Events | Export-Csv -Path "C:\Temp\TimeChangeEvents.csv" -NoTypeInformation

# Create detailed report with time differences
$Report = foreach ($Event in $Events) {
    $EventXML = [xml]$Event.ToXml()
    $OldTime = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'OldTime'} | Select-Object -ExpandProperty '#text'
    $NewTime = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'NewTime'} | Select-Object -ExpandProperty '#text'
    [PSCustomObject]@{
        EventTime = $Event.TimeCreated
        OldSystemTime = $OldTime
        NewSystemTime = $NewTime
        TimeDifference = ([DateTime]$NewTime - [DateTime]$OldTime).TotalSeconds
        ProcessId = $Event.ProcessId
        UserId = $Event.UserId
    }
}
$Report | Export-Csv -Path "C:\Temp\TimeChangeAnalysis.csv" -NoTypeInformation

2. Check registry entries related to time service configuration:

# Windows Time Service registry settings
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters"
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config"

# Time zone information
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\TimeZoneInformation"

3. Correlate with other security events for comprehensive timeline:

# Get related events around time changes
$TimeChanges = Get-WinEvent -FilterHashtable @{LogName='System'; Id=5889} -MaxEvents 10
foreach ($Change in $TimeChanges) {
    $StartTime = $Change.TimeCreated.AddMinutes(-10)
    $EndTime = $Change.TimeCreated.AddMinutes(10)
    
    Write-Host "=== Time Change at $($Change.TimeCreated) ===" -ForegroundColor Cyan
    
    # Check for logon events
    Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$StartTime; EndTime=$EndTime} -ErrorAction SilentlyContinue | 
        Select-Object TimeCreated, Id, @{Name='Event';Expression={if($_.Id -eq 4624){'Logon Success'}else{'Logon Failure'}}}
    
    # Check for privilege use
    Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672; StartTime=$StartTime; EndTime=$EndTime} -ErrorAction SilentlyContinue | 
        Select-Object TimeCreated, Id, @{Name='Event';Expression={'Special Privileges Assigned'}}
}

4. Generate forensic timeline for incident response:

# Create comprehensive timeline
$Timeline = @()
$Timeline += Get-WinEvent -FilterHashtable @{LogName='System'; Id=5889} -MaxEvents 50 | 
    Select-Object TimeCreated, @{Name='EventType';Expression={'Time Change'}}, @{Name='Source';Expression={'System'}}, Message
$Timeline += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4672} -MaxEvents 100 | 
    Select-Object TimeCreated, @{Name='EventType';Expression={'Security'}}, @{Name='Source';Expression={'Security'}}, Message

$Timeline | Sort-Object TimeCreated -Descending | Export-Csv -Path "C:\Temp\SecurityTimeline.csv" -NoTypeInformation