I have a problem in my server that the system time is automatically getting changed by a day and getting back to normal. I have some software installed for time sych. But the master clock seem to be fine. So I am suspecting if some other process is changing the time. I have enabled the event logging for time change. But it is not having the process name in it. Is there a way to find the process name that changes the system time in Win-server-2003??



tasklist /svc

on the commandline.

The svchost that hosts W32Time is your culprit.


If you suspect an ongoing process that's doing it, you may be able to check it for the SE_SYSTEMTIME_NAME privilege. Process Explorer shows it on the Security tab of process details as SeSystemtimePrivilege, but you'd have to check that on a per-process basis. This may not help if a process is simply launching another process to update system time.

You may be able to work from the code in this Stack Overflow article: https://stackoverflow.com/questions/2094663/determine-if-windows-process-has-privilege-to-create-symbolic-link to run a check for processes that have that privilege.

Also of note on Windows servers you shouldn't need third-party software for time synchronization - you should be able to specify NTP server(s) that the system will automatically sync to; if the server is disconnected from the Internet you should still be able to check against your DCs (if on a domain).

Also of possible interest is the MSDN information on changing system or local time (start from http://msdn.microsoft.com/en-us/library/ms724942%28v=VS.85%29.aspx) or time zone.


Is the server part of a domain? Is it a domain controller? In a Windows domain, the PDC emulator is by default the authoritative time server for the domain; all domain members synchronize with the PDC (via the Windows Time Service). The PDC is generally configured to sync with an Internet time source, by default time.windows.com which seems to me to be an unreliable source of time.

To learn more about the Windows Time Service, start here: http://technet.microsoft.com/en-us/library/cc773061(WS.10).aspx

  • Just a minor correction, in a multi-site environment all DCs sync with the PDC emulator, and other domain members sync with their closest DC. – ThatGraemeGuy Nov 8 '11 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.