Windows Event ID 11724 – Microsoft-Windows-Kernel-General: System Time Change Detected

Start by examining the specific details of Event ID 11724 to understand the time change context and magnitude.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 11724 in the Event IDs field and click OK
5. Double-click on recent Event ID 11724 entries to view detailed information
6. Examine the event data for old time value, new time value, and process ID
7. Note the time difference magnitude and frequency of occurrences

Use PowerShell for automated analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=11724} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Investigate the Windows Time Service settings to determine if time synchronization is causing frequent adjustments.

1. Open Command Prompt as Administrator
2. Check current time service configuration:

w32tm /query /configuration

3. Review time source and synchronization settings:

w32tm /query /source
w32tm /query /status

4. Examine time service event logs:

Get-WinEvent -LogName 'System' -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-Time-Service']]]" -MaxEvents 20

5. Check registry settings for time service configuration:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config' | Format-List

6. If using domain time synchronization, verify domain controller connectivity and time accuracy

Identify which processes are initiating time changes and correlate with security events for comprehensive analysis.

1. Extract process information from Event ID 11724 entries:

$events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=11724} -MaxEvents 100
$events | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        ProcessId = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text'
        OldTime = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'OldTime'} | Select-Object -ExpandProperty '#text'
        NewTime = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'NewTime'} | Select-Object -ExpandProperty '#text'
    }
} | Format-Table -AutoSize

2. Cross-reference process IDs with running processes and services:

Get-Process | Where-Object {$_.Id -in @(1234, 5678)} | Select-Object Id, ProcessName, Path, StartTime

3. Check for related security events indicating manual time changes:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4616} -MaxEvents 20 | Select-Object TimeCreated, Id, Message

4. Review application and service logs for time-related errors:

Get-WinEvent -FilterHashtable @{LogName='Application'; Level=2,3; StartTime=(Get-Date).AddDays(-1)} | Where-Object {$_.Message -match 'time|clock|sync'} | Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message

Investigate potential hardware issues causing excessive time drift and system performance impacts.

1. Check system hardware clock accuracy against reliable time sources:

w32tm /stripchart /computer:time.windows.com /samples:5 /dataonly

2. Monitor system performance counters related to time keeping:

Get-Counter -Counter '\System\System Up Time', '\Processor(_Total)\% Processor Time', '\Memory\Available MBytes' -SampleInterval 5 -MaxSamples 12

3. Examine system event logs for hardware-related issues:

Get-WinEvent -FilterHashtable @{LogName='System'; Level=2,3; StartTime=(Get-Date).AddDays(-7)} | Where-Object {$_.Message -match 'hardware|clock|RTC|CMOS'} | Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message

4. Check virtual machine integration services if running on a hypervisor:

Get-Service -Name 'vmictimesync*' | Select-Object Name, Status, StartType
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters' -ErrorAction SilentlyContinue

5. Review BIOS/UEFI settings for time and date configuration, especially on physical systems experiencing frequent time drift

Set up comprehensive monitoring and automated responses for time change events in enterprise environments.

1. Create a PowerShell script for continuous time change monitoring:

# TimeChangeMonitor.ps1
$logName = 'System'
$eventId = 11724
$threshold = 60 # seconds

Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='$logName' AND EventCode=$eventId" -Action {
    $event = $Event.SourceEventArgs.NewEvent
    $timeDiff = [Math]::Abs(([DateTime]$event.NewTime - [DateTime]$event.OldTime).TotalSeconds)
    
    if ($timeDiff -gt $threshold) {
        Write-EventLog -LogName 'Application' -Source 'TimeMonitor' -EventId 1001 -EntryType Warning -Message "Large time change detected: $timeDiff seconds"
        # Add email notification or SIEM integration here
    }
}

2. Configure Windows Event Forwarding for centralized time event collection:

wecutil cs TimeChangeSubscription.xml

3. Set up scheduled task to analyze time change patterns:

$action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\AnalyzeTimeChanges.ps1'
$trigger = New-ScheduledTaskTrigger -Daily -At '06:00'
$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount
Register-ScheduledTask -TaskName 'TimeChangeAnalysis' -Action $action -Trigger $trigger -Principal $principal

4. Implement Group Policy settings to restrict manual time changes:

# Check current time change privileges
secedit /export /cfg C:\temp\current_policy.inf
Select-String -Path C:\temp\current_policy.inf -Pattern 'SeSystemtimePrivilege'

5. Create custom performance counters and alerts in monitoring systems like SCOM or third-party solutions