#time-synchronization

Windows Event ID 15 – Kernel-General: System Time Changed

Event ID 15 from Kernel-General logs when the system time is changed, either manually by users, automatically by time synchronization services, or due to hardware clock adjustments.

Windows Event ID 12010 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 12010 fires when Windows detects a system time change, either manual or automatic. Critical for security auditing and troubleshooting time synchronization issues in domain environments.

Windows Event ID 33 – System: Time Service Provider Time Synchronization

Event ID 33 indicates Windows Time Service has successfully synchronized system time with an external time source or encountered synchronization issues during the process.

Windows Event ID 1511 – Kernel-General: System Time Change Detected

Event ID 1511 fires when Windows detects a significant system time change, either from manual adjustment, NTP synchronization, or hardware clock drift. Critical for security auditing and troubleshooting time-sensitive applications.

Windows Event ID 1796 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 1796 fires when Windows detects a system time change, either manual adjustment or automatic synchronization. Critical for security auditing and troubleshooting time-sensitive applications.