3

When I logged into my workstation this morning, the timezone had been changed from Eastern to Pacific. In the event viewer I see the following three events, all at 4:12:15 AM.

It looks like the timezone was not changed for the 1st and 2nd event but then somehow in the 3rd event changed from a timezone of T11 to T08. This is all very odd because I believe that when I installed the OS, that I set the timezone correctly to Eastern (I'm near NYC).

Here are the event logs:

1st event

The system time was changed.

Subject:
    Security ID:        LOCAL SERVICE
    Account Name:       LOCAL SERVICE
    Account Domain:     NT AUTHORITY
    Logon ID:       0x3E5

Process Information:
    Process ID: 0x3d8
    Name:       C:\Windows\System32\svchost.exe

Previous Time:  ‎2014‎-‎04‎-‎25T08:12:15.456072100Z
New Time:       ‎2014‎-‎04‎-‎25T08:12:15.455000000Z

2nd event:

Previous Time:  ‎2014‎-‎04‎-‎25T08:12:15.456888000Z
New Time:       ‎2014‎-‎04‎-‎25T08:12:15.456000000Z

3rd event:

Previous Time:  ‎2014‎-‎04‎-‎25T11:12:04.008461800Z
New Time:       ‎2014‎-‎04‎-‎25T08:12:15.456616800Z

Is there a benign explanation for this or could this be a virus?

Update 2014-05-01: More occurrences

This event happened three more times on 2014-04-26, all at exactly 3:02:15 AM. The event has not occurred since then.

Previous Time:   ‎2014‎-‎04‎-‎26T07:02:15.198939400Z
New Time:        2014‎-‎04‎-‎26T07:02:15.198000000Z
Previous Time:   2014‎-‎04‎-‎26T07:02:15.200081200Z
New Time:        ‎2014‎-‎04‎-‎26T07:02:15.199000000Z
Previous Time:   ‎2014‎-‎04‎-‎26T07:02:13.067340800Z
New Time:        ‎2014‎-‎04‎-‎26T07:02:15.199708000Z

Update 2014-04-26: Result of w32tm /query /configuration

[Configuration]

EventLogFlags: 2 (Local)
AnnounceFlags: 10 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 10 (Local)
MaxPollInterval: 15 (Local)
MaxNegPhaseCorrection: 54000 (Local)
MaxPosPhaseCorrection: 54000 (Local)
MaxAllowedPhaseOffset: 1 (Local)

FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 1 (Local)
UpdateInterval: 360000 (Local)


[TimeProviders]

NtpClient (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Local)
ResolvePeerBackoffMaxTimes: 7 (Local)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 1 (Local)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 604800 (Local)
Type: NTP (Local)
NtpServer: time.windows.com,0x9 (Local)

NtpServer (Local)
DllName: C:\Windows\system32\w32time.dll (Local)
Enabled: 0 (Local)
InputProvider: 0 (Local)
VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 0 (Local)
InputProvider: 1 (Local)
8
  • Do you have it synced with a proper NTP time source? If you don't know you can check with this command: w32tm /query /configuration Apr 26, 2014 at 15:33
  • 1
    Weird. Also, this is Zulu time/UTC (notice the Z at the end) and should thus be timezone-agnostic.
    – MichelZ
    Apr 26, 2014 at 16:15
  • @BradBouchard - I started the Windows Time service and ran that command as Administrator. The results have been posted in an update to the question. Apr 26, 2014 at 17:01
  • Also, on the "Internet Time" tab of the Date and Time panel it says "This computer is set to automatically synchronize with 'time.windows.com'. Apr 26, 2014 at 17:08
  • Is the issue still happening? Apr 30, 2014 at 19:34

1 Answer 1

1

You need to look for the following type of event:

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          8/17/2014 1:35:21 PM
Event ID:      1
Task Category: None
Level:         Information
Keywords:      Time
User:          MYDOMAIN\Administrator
Computer:      WIN-3RBJO240LH2.mydomain.local
Description:
The system time has changed to ‎2014‎-‎08‎-‎17T16:35:21.300689700Z from ‎2014‎-‎08‎-‎17T16:35:21.300689700Z.

Change Reason: System time adjusted to the new time zone.

You can see the time change was done because of a new timezone and which user did it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .