I have a problem in my server that the system time is automatically getting changed by a day and getting back to normal. I have some software installed for time sych. But the master clock seem to be fine. So I am suspecting if some other process is changing the time. I have enabled the event logging for time change. But it is not having the process name in it. Is there a way to find the process name that changes the system time in Win-server-2003??
on the commandline.
The svchost that hosts W32Time is your culprit.
If you suspect an ongoing process that's doing it, you may be able to check it for the SE_SYSTEMTIME_NAME privilege. Process Explorer shows it on the Security tab of process details as SeSystemtimePrivilege, but you'd have to check that on a per-process basis. This may not help if a process is simply launching another process to update system time.
You may be able to work from the code in this Stack Overflow article: https://stackoverflow.com/questions/2094663/determine-if-windows-process-has-privilege-to-create-symbolic-link to run a check for processes that have that privilege.
Also of note on Windows servers you shouldn't need third-party software for time synchronization - you should be able to specify NTP server(s) that the system will automatically sync to; if the server is disconnected from the Internet you should still be able to check against your DCs (if on a domain).
Also of possible interest is the MSDN information on changing system or local time (start from http://msdn.microsoft.com/en-us/library/ms724942%28v=VS.85%29.aspx) or time zone.
Is the server part of a domain? Is it a domain controller? In a Windows domain, the PDC emulator is by default the authoritative time server for the domain; all domain members synchronize with the PDC (via the Windows Time Service). The PDC is generally configured to sync with an Internet time source, by default
time.windows.com which seems to me to be an unreliable source of time.
To learn more about the Windows Time Service, start here: http://technet.microsoft.com/en-us/library/cc773061(WS.10).aspx