#windows-time-service

Windows Event ID 8231 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 8231 fires when Windows detects a system time change, typically during time synchronization, manual adjustments, or hardware clock drift corrections.

Windows Event ID 8197 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 8197 fires when Windows detects a significant system time change, either manual adjustment or automatic synchronization. Critical for security auditing and troubleshooting time-related issues.

Windows Event ID 4113 – Microsoft-Windows-Kernel-General: System Time Changed

Event ID 4113 fires when the Windows system time is changed, either manually by a user or automatically by time synchronization services. Critical for security auditing and compliance tracking.

Windows Event ID 3086 – Microsoft-Windows-Kernel-General: System Time Change Detected

Event ID 3086 fires when Windows detects a significant system time change, either from manual adjustment, NTP synchronization, or hardware clock drift requiring investigation.

Windows Event ID 33 – System: Time Service Provider Time Synchronization

Event ID 33 indicates Windows Time Service has successfully synchronized system time with an external time source or encountered synchronization issues during the process.