Windows Event ID 1511 – Kernel-General: System Time Change Detected

Start by examining the specific details of the Event ID 1511 occurrence to understand what triggered the time change.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 1511 by right-clicking the System log and selecting Filter Current Log
4. Enter 1511 in the Event IDs field and click OK
5. Double-click on recent Event ID 1511 entries to view details
6. Examine the General tab for old time, new time, and time difference
7. Check the Details tab for additional information about the process that initiated the change

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1511} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Investigate the Windows Time service configuration to determine if automatic time synchronization is causing the events.

1. Open Command Prompt as Administrator
2. Check current time service status:

w32tm /query /status

3. Review time service configuration:

w32tm /query /configuration

4. Check time source and synchronization peers:

w32tm /query /peers

5. Examine time service registry settings:

Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters"

6. For domain-joined machines, verify domain hierarchy:

w32tm /query /source

Create a comprehensive monitoring solution to track time changes and identify patterns or anomalies.

1. Create a PowerShell script to monitor time change events:

# Monitor Event ID 1511 for time changes
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1511; StartTime=(Get-Date).AddDays(-7)}

foreach ($Event in $Events) {
    $EventXML = [xml]$Event.ToXml()
    $OldTime = $EventXML.Event.EventData.Data[0].'#text'
    $NewTime = $EventXML.Event.EventData.Data[1].'#text'
    
    Write-Host "Time Change Detected:"
    Write-Host "  Date: $($Event.TimeCreated)"
    Write-Host "  Old Time: $OldTime"
    Write-Host "  New Time: $NewTime"
    Write-Host "  Process: $($Event.ProcessId)"
    Write-Host "---"
}

2. Check for related time service events:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Time-Service'} -MaxEvents 50

3. Monitor for large time adjustments that might indicate issues:

# Alert on time changes greater than 1 minute
$LargeTimeChanges = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1511; StartTime=(Get-Date).AddHours(-24)} | Where-Object {
    $EventXML = [xml]$_.ToXml()
    $TimeDiff = [Math]::Abs(([DateTime]$EventXML.Event.EventData.Data[1].'#text') - ([DateTime]$EventXML.Event.EventData.Data[0].'#text')).TotalSeconds
    $TimeDiff -gt 60
}

if ($LargeTimeChanges) {
    Write-Warning "Large time changes detected in the last 24 hours"
    $LargeTimeChanges | Format-Table TimeCreated, Id, Message
}

Examine hardware clock stability and virtual machine time synchronization settings that might cause frequent time adjustments.

1. Check system hardware clock accuracy:

w32tm /stripchart /computer:time.windows.com /samples:5

2. For virtual machines, check hypervisor time synchronization settings:

# Check if running in VM
$ComputerSystem = Get-WmiObject -Class Win32_ComputerSystem
if ($ComputerSystem.Model -match "Virtual|VMware|Hyper-V|VirtualBox") {
    Write-Host "Virtual machine detected: $($ComputerSystem.Model)"
    
    # Check VM integration services
    Get-Service | Where-Object {$_.Name -match "vmtools|hypervvssd|vboxservice"}
}

3. Examine system event logs for hardware-related time issues:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-General'} -MaxEvents 100 | Where-Object {$_.Message -match "time|clock"}

4. Check BIOS/UEFI time settings and battery status:

# Check system firmware time
$BiosTime = Get-WmiObject -Class Win32_BIOS | Select-Object ReleaseDate
$SystemTime = Get-Date
Write-Host "Current System Time: $SystemTime"
Write-Host "BIOS Release Date: $($BiosTime.ReleaseDate)"

# Check for CMOS battery issues in System log
Get-WinEvent -FilterHashtable @{LogName='System'} -MaxEvents 1000 | Where-Object {$_.Message -match "CMOS|battery|clock"}

5. For Hyper-V guests, disable time synchronization if causing issues:

# Disable Hyper-V time synchronization (run in VM)
Set-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider" -Name "Enabled" -Value 0

Set up comprehensive monitoring for time changes to meet security and compliance requirements.

1. Create a scheduled task to log time changes to a separate file:

# Create monitoring script
$ScriptContent = @'
$Events = Get-WinEvent -FilterHashtable @{LogName="System"; Id=1511; StartTime=(Get-Date).AddMinutes(-5)}
foreach ($Event in $Events) {
    $EventXML = [xml]$Event.ToXml()
    $LogEntry = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - Time Change: Old=$($EventXML.Event.EventData.Data[0].'#text') New=$($EventXML.Event.EventData.Data[1].'#text') Process=$($Event.ProcessId)"
    Add-Content -Path "C:\Logs\TimeChanges.log" -Value $LogEntry
}
'@

# Save script
New-Item -Path "C:\Scripts" -ItemType Directory -Force
$ScriptContent | Out-File -FilePath "C:\Scripts\MonitorTimeChanges.ps1" -Encoding UTF8

2. Create scheduled task to run the monitoring script:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\MonitorTimeChanges.ps1"
$Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries

Register-ScheduledTask -TaskName "MonitorTimeChanges" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

3. Set up Windows Event Forwarding for centralized monitoring:

wecutil qc /q
winrm quickconfig

4. Configure audit policy for time changes:

auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable

5. Create PowerShell function for compliance reporting:

function Get-TimeChangeReport {
    param(
        [DateTime]$StartDate = (Get-Date).AddDays(-30),
        [DateTime]$EndDate = (Get-Date)
    )
    
    $Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1511; StartTime=$StartDate; EndTime=$EndDate}
    
    $Report = $Events | ForEach-Object {
        $EventXML = [xml]$_.ToXml()
        [PSCustomObject]@{
            TimeCreated = $_.TimeCreated
            OldTime = $EventXML.Event.EventData.Data[0].'#text'
            NewTime = $EventXML.Event.EventData.Data[1].'#text'
            ProcessId = $_.ProcessId
            MachineName = $_.MachineName
        }
    }
    
    return $Report | Sort-Object TimeCreated
}

# Generate report
Get-TimeChangeReport | Export-Csv -Path "C:\Reports\TimeChangeReport.csv" -NoTypeInformation