Windows Event ID 16384 – Microsoft-Windows-Kernel-General: System Time Change Detected

Start by examining the specific details of Event ID 16384 to understand what triggered the time change.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 16384 by right-clicking the System log and selecting Filter Current Log
4. Enter 16384 in the Event IDs field and click OK
5. Double-click on recent Event 16384 entries to view detailed information
6. Check the General tab for old and new time values
7. Review the Details tab for process information and change source

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=16384} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Investigate the Windows Time service configuration to understand automatic time synchronization behavior.

1. Open an elevated Command Prompt or PowerShell
2. Check the current time service configuration:

w32tm /query /configuration

3. Review the time source and synchronization settings:

w32tm /query /source
w32tm /query /status

4. Check for recent time synchronization events:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Time-Service'} -MaxEvents 10

5. Verify domain time synchronization hierarchy:

w32tm /query /peers

6. Test manual synchronization to identify issues:

w32tm /resync /force

Examine the frequency and patterns of time changes to identify potential issues or establish baselines.

1. Query Event 16384 occurrences over the past 30 days:

$StartTime = (Get-Date).AddDays(-30)
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=16384; StartTime=$StartTime}
$Events | Group-Object {$_.TimeCreated.Date} | Sort-Object Name

2. Create a detailed analysis of time changes:

$Events | ForEach-Object {
    $EventXML = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        ProcessId = $EventXML.Event.EventData.Data[0].'#text'
        ProcessName = $EventXML.Event.EventData.Data[1].'#text'
        OldTime = $EventXML.Event.EventData.Data[2].'#text'
        NewTime = $EventXML.Event.EventData.Data[3].'#text'
    }
} | Format-Table -AutoSize

3. Check for correlation with system events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=@(1074,6005,6006,16384); StartTime=$StartTime} | Sort-Object TimeCreated

4. Export time change data for further analysis:

$Events | Export-Csv -Path "C:\Temp\TimeChanges.csv" -NoTypeInformation

Examine time changes from a security perspective and ensure compliance with audit requirements.

1. Check for unauthorized time changes by correlating with user logon events:

$TimeChanges = Get-WinEvent -FilterHashtable @{LogName='System'; Id=16384; StartTime=(Get-Date).AddDays(-7)}
$LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)}

# Correlate time changes with user sessions
$TimeChanges | ForEach-Object {
    $ChangeTime = $_.TimeCreated
    $NearbyLogons = $LogonEvents | Where-Object {[Math]::Abs(($_.TimeCreated - $ChangeTime).TotalMinutes) -lt 30}
    [PSCustomObject]@{
        TimeChange = $ChangeTime
        NearbyLogons = $NearbyLogons.Count
        Users = ($NearbyLogons | ForEach-Object {([xml]$_.ToXml()).Event.EventData.Data[5].'#text'} | Select-Object -Unique) -join ', '
    }
}

2. Review Group Policy settings affecting time synchronization:

Get-ItemProperty -Path "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" -ErrorAction SilentlyContinue
Get-ItemProperty -Path "HKLM\SOFTWARE\Policies\Microsoft\W32Time\Config" -ErrorAction SilentlyContinue

3. Check for time-related security events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=@(4616,4624,4625)} -MaxEvents 50 | Where-Object {$_.Message -match 'time|clock'}

4. Generate compliance report for time changes:

$Report = $TimeChanges | ForEach-Object {
    $EventXML = [xml]$_.ToXml()
    [PSCustomObject]@{
        Timestamp = $_.TimeCreated
        EventId = $_.Id
        Source = $_.ProviderName
        ProcessId = $EventXML.Event.EventData.Data[0].'#text'
        ProcessName = $EventXML.Event.EventData.Data[1].'#text'
        Description = "System time changed"
        Impact = "Potential authentication/audit impact"
    }
}
$Report | Export-Csv -Path "C:\Temp\TimeChangeAudit.csv" -NoTypeInformation

Set up proactive monitoring for time changes to detect issues before they impact operations.

1. Create a scheduled task to monitor time changes:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-WindowStyle Hidden -Command \"Get-WinEvent -FilterHashtable @{LogName='System'; Id=16384; StartTime=(Get-Date).AddMinutes(-5)} | Export-Csv -Path 'C:\Logs\TimeChanges.csv' -Append -NoTypeInformation\""
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "TimeChangeMonitor" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

2. Configure Windows Event Forwarding for centralized monitoring:

# On collector server
wecutil qc /q

# Create subscription for Event 16384
$SubscriptionXML = @"
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>TimeChangeEvents</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Description>Forward Event ID 16384 time change events</Description>
    <Enabled>true</Enabled>
    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
    <ConfigurationMode>Normal</ConfigurationMode>
    <Query>
        <![CDATA[
        <QueryList>
            <Query Id="0">
                <Select Path="System">*[System[EventID=16384]]</Select>
            </Query>
        </QueryList>
        ]]>
    </Query>
</Subscription>
"@

$SubscriptionXML | Out-File -FilePath "C:\Temp\TimeChangeSubscription.xml"
wecutil cs "C:\Temp\TimeChangeSubscription.xml"

3. Set up registry monitoring for time service changes:

# Monitor W32Time registry changes
$RegPath = "HKLM\SYSTEM\CurrentControlSet\Services\W32Time"
Register-WmiEvent -Query "SELECT * FROM RegistryTreeChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND RootPath='SYSTEM\\CurrentControlSet\\Services\\W32Time'" -Action {
    Write-EventLog -LogName Application -Source "TimeMonitor" -EventId 1001 -Message "W32Time registry modification detected"
}