Event ID: 4616The system time was changed
The system time was changed. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Process Information: Process ID: %7 [Windows 7+] Name: %8 [Windows 7+] Previous Time: %5 New Time: %6 This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
This event generates every time system time was changed.
This event is always logged regardless of the "Audit Security State Change" sub-category setting.
You will typically see these events with “Subject\Security ID” = “LOCAL SERVICE”, indicating a normal time correction action.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Security State Change"
LEFT/RIGHT arrow keys for navigationBack to List