Windows Event ID 15 – Kernel-General: System Time Changed

Start by examining the specific details of Event ID 15 to understand what triggered the time change.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 15 in the Event IDs field and click OK
5. Double-click on recent Event ID 15 entries to view detailed information
6. Examine the General tab for old time, new time, and the process responsible
7. Check the Details tab for additional XML data including the exact time difference

Look for patterns in timing and frequency. Legitimate W32Time synchronization typically occurs at regular intervals, while manual changes appear as isolated events.

Use PowerShell to efficiently query and analyze time change events across multiple systems.

1. Open PowerShell as Administrator
2. Query recent time change events:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=15} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -AutoSize

3. For detailed analysis of time changes in the last 24 hours:

   $StartTime = (Get-Date).AddDays(-1)
   Get-WinEvent -FilterHashtable @{LogName='System'; Id=15; StartTime=$StartTime} | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           OldTime = $xml.Event.EventData.Data[0].'#text'
           NewTime = $xml.Event.EventData.Data[1].'#text'
           Reason = $xml.Event.EventData.Data[2].'#text'
       }
   }

4. To check time synchronization status:

   w32tm /query /status

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=15} -MaxEvents 100 | Export-Csv -Path "C:\temp\TimeChangeEvents.csv" -NoTypeInformation

Examine the Windows Time service configuration to understand automatic time synchronization behavior.

1. Check current time service configuration:

   w32tm /query /configuration

2. Verify time synchronization sources:

   w32tm /query /source

3. Review time service registry settings:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters"

4. Check time synchronization intervals in the registry:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config"

5. For domain-joined computers, verify Group Policy time settings:

   gpresult /h C:\temp\gpresult.html

6. Test manual time synchronization:

   w32tm /resync /force

7. Monitor the System log immediately after the resync to see if Event ID 15 appears

Investigate potential security concerns related to unauthorized time changes and maintain proper audit trails.

1. Check Security log for related logon events around time changes:

   $TimeChangeEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=15} -MaxEvents 10
   foreach ($Event in $TimeChangeEvents) {
       $StartTime = $Event.TimeCreated.AddMinutes(-5)
       $EndTime = $Event.TimeCreated.AddMinutes(5)
       Write-Host "Time change at: $($Event.TimeCreated)"
       Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$StartTime; EndTime=$EndTime} | Select-Object TimeCreated, Id, Message
   }

2. Review Process Creation events (Event ID 4688) for time-related commands:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -match "w32tm|date|time"} | Select-Object TimeCreated, Message

3. Check for privilege escalation events before time changes:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} | Select-Object TimeCreated, Message | Format-Table -AutoSize

4. Examine Group Policy changes that might affect time synchronization:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503} | Select-Object TimeCreated, Message

5. Create a monitoring script for suspicious time changes:

   # Save as Monitor-TimeChanges.ps1
   $LastCheck = (Get-Date).AddHours(-1)
   Get-WinEvent -FilterHashtable @{LogName='System'; Id=15; StartTime=$LastCheck} | ForEach-Object {
       if ($_.Message -notmatch "W32Time") {
           Write-Warning "Suspicious time change detected at $($_.TimeCreated)"
           $_.Message
       }
   }

Implement comprehensive monitoring for time changes to detect anomalies and maintain security compliance.

1. Create a scheduled task to monitor time changes:

   # Create XML for scheduled task
   $TaskXML = @"
   
   
     
       
         <QueryList><Query Id="0" Path="System"><Select Path="System">*[System[EventID=15]]</Select></Query></QueryList>
       
     
     
       
         powershell.exe
         -File "C:\Scripts\TimeChangeAlert.ps1"
       
     
   
   "@
   $TaskXML | Out-File -FilePath "C:\temp\TimeChangeMonitor.xml" -Encoding Unicode

2. Register the scheduled task:

   Register-ScheduledTask -TaskName "TimeChangeMonitor" -Xml (Get-Content "C:\temp\TimeChangeMonitor.xml" | Out-String)

3. Create the alert script (C:\Scripts\TimeChangeAlert.ps1):

   # TimeChangeAlert.ps1
   $Event = Get-WinEvent -FilterHashtable @{LogName='System'; Id=15} -MaxEvents 1
   $xml = [xml]$Event.ToXml()
   $OldTime = $xml.Event.EventData.Data[0].'#text'
   $NewTime = $xml.Event.EventData.Data[1].'#text'
   $Reason = $xml.Event.EventData.Data[2].'#text'
   
   # Send email alert or write to custom log
   Write-EventLog -LogName "Application" -Source "TimeMonitor" -EventId 1001 -EntryType Warning -Message "Time changed from $OldTime to $NewTime. Reason: $Reason"

4. Configure Windows Event Forwarding for centralized monitoring:

   # On collector server
   wecutil qc /q
   # Create subscription for Event ID 15
   wecutil cs C:\temp\TimeChangeSubscription.xml

5. Set up registry monitoring for time service changes:

   $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time"
   $Action = {
       Write-EventLog -LogName "Application" -Source "TimeMonitor" -EventId 1002 -EntryType Information -Message "Time service registry modified"
   }
   Register-WmiEvent -Query "SELECT * FROM RegistryTreeChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND RootPath='SYSTEM\\CurrentControlSet\\Services\\W32Time'" -Action $Action