Windows Event ID 11728 – Microsoft-Windows-Kernel-General: System Time Change Detected

Start by examining the specific details of Event ID 11728 to understand the time change context and magnitude.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 11728 in the Event IDs field and click OK
5. Double-click on recent Event ID 11728 entries to view detailed information
6. Review the General tab for time change details including old time, new time, and time delta
7. Check the Details tab for additional XML data including process information

Use PowerShell for more detailed analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=11728} -MaxEvents 20 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Investigate the Windows Time Service configuration to determine if time changes are expected behavior.

1. Open an elevated Command Prompt or PowerShell session
2. Check current time service status:

w32tm /query /status

3. Review time service configuration:

w32tm /query /configuration

4. Check NTP server sources:

w32tm /query /peers

5. For domain-joined systems, verify domain controller time sync:

w32tm /monitor /domain

6. Review time service registry settings at HKLM\SYSTEM\CurrentControlSet\Services\W32Time
7. Check for third-party time sync software in Programs and Features

Create a comprehensive analysis of time change patterns to identify underlying issues.

1. Extract detailed time change information:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=11728; StartTime=(Get-Date).AddDays(-30)}
$TimeChanges = $Events | ForEach-Object {
    $XML = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        OldTime = $XML.Event.EventData.Data[0].'#text'
        NewTime = $XML.Event.EventData.Data[1].'#text'
        ProcessId = $XML.Event.EventData.Data[2].'#text'
    }
}
$TimeChanges | Export-Csv -Path "C:\Temp\TimeChanges.csv" -NoTypeInformation

2. Analyze time change frequency:

$TimeChanges | Group-Object {$_.TimeCreated.Date} | Select-Object Name, Count | Sort-Object Name

3. Calculate average time drift:

$TimeChanges | ForEach-Object {
    $OldTime = [DateTime]$_.OldTime
    $NewTime = [DateTime]$_.NewTime
    $DriftSeconds = ($NewTime - $OldTime).TotalSeconds
    [PSCustomObject]@{
        Date = $_.TimeCreated.Date
        DriftSeconds = $DriftSeconds
    }
} | Measure-Object DriftSeconds -Average -Maximum -Minimum

4. Set up continuous monitoring with a scheduled task to track excessive drift

Examine hardware-related causes of time drift, particularly relevant for virtual machines and aging hardware.

1. For virtual machines, check hypervisor time synchronization settings:

# VMware - Check VMware Tools time sync
Get-Service -Name "VMTools" | Select-Object Status, StartType
# Hyper-V - Check integration services
Get-VMIntegrationService -VMName $env:COMPUTERNAME -Name "Time Synchronization"

2. Review system hardware information:

Get-WmiObject -Class Win32_ComputerSystem | Select-Object Manufacturer, Model, TotalPhysicalMemory
Get-WmiObject -Class Win32_BIOS | Select-Object Manufacturer, Version, ReleaseDate

3. Check for hardware clock issues in System log:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1,6013,35,37} -MaxEvents 50 | Where-Object {$_.Message -like "*time*" -or $_.Message -like "*clock*"}

4. For physical systems, verify CMOS battery status and BIOS time settings
5. Review power management settings that might affect hardware clock:

powercfg /query SCHEME_CURRENT SUB_SLEEP

6. Check Windows Hardware Error Architecture (WHEA) logs for hardware issues:

Get-WinEvent -LogName "Microsoft-Windows-Kernel-WHEA/Errors" -MaxEvents 20

Implement comprehensive monitoring to proactively detect and alert on time synchronization issues.

1. Create a custom Event Viewer view for time-related events:

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[(EventID=11728 or EventID=1 or EventID=35 or EventID=37)]]</Select>
  </Query>
</QueryList>

2. Set up PowerShell-based monitoring script:

# Save as Monitor-TimeChanges.ps1
param(
    [int]$MaxDriftSeconds = 60,
    [string]$EmailTo = "admin@company.com",
    [string]$SMTPServer = "mail.company.com"
)

$RecentEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=11728; StartTime=(Get-Date).AddHours(-1)}
foreach ($Event in $RecentEvents) {
    $XML = [xml]$Event.ToXml()
    $OldTime = [DateTime]$XML.Event.EventData.Data[0].'#text'
    $NewTime = [DateTime]$XML.Event.EventData.Data[1].'#text'
    $DriftSeconds = [Math]::Abs(($NewTime - $OldTime).TotalSeconds)
    
    if ($DriftSeconds -gt $MaxDriftSeconds) {
        $Subject = "High Time Drift Detected on $env:COMPUTERNAME"
        $Body = "Time drift of $DriftSeconds seconds detected at $($Event.TimeCreated)"
        Send-MailMessage -To $EmailTo -Subject $Subject -Body $Body -SmtpServer $SMTPServer
    }
}

3. Create scheduled task for monitoring:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-TimeChanges.ps1"
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "TimeChangeMonitoring" -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest

4. Configure Windows Event Forwarding for centralized monitoring in enterprise environments
5. Implement SCOM or other monitoring solutions to track time synchronization across the infrastructure