Windows Event ID 1796 – Microsoft-Windows-Kernel-General: System Time Change Detected

Start by examining the specific Event ID 1796 entries to understand the time change patterns and sources.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 1796 in the Event IDs field and click OK
5. Double-click each Event ID 1796 entry to examine the details
6. Note the Old Time and New Time values in the event data
7. Check the Reason field to identify what triggered the time change
8. Look for patterns in timing and frequency of these events

Pay special attention to large time adjustments or frequent changes that might indicate synchronization problems or unauthorized modifications.

Use PowerShell to extract and analyze Event ID 1796 data for comprehensive time change tracking.

1. Open PowerShell as Administrator
2. Run this command to retrieve recent time change events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1796} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

3. For detailed analysis of time adjustments, use:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1796} | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        OldTime = $xml.Event.EventData.Data[0].'#text'
        NewTime = $xml.Event.EventData.Data[1].'#text'
        Reason = $xml.Event.EventData.Data[2].'#text'
    }
} | Format-Table -AutoSize

4. To export results for further analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1796} | Export-Csv -Path "C:\Temp\TimeChangeEvents.csv" -NoTypeInformation

Check the Windows Time service settings to ensure proper NTP synchronization and identify potential configuration issues.

1. Open Command Prompt as Administrator
2. Check current time service status:

w32tm /query /status

3. Review time source configuration:

w32tm /query /configuration

4. Check time synchronization peers:

w32tm /query /peers

5. In PowerShell, examine the Windows Time service registry settings:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" | Select-Object NtpServer, Type

6. Verify time service is running:

Get-Service W32Time | Select-Object Name, Status, StartType

7. If issues are found, restart the time service:

net stop w32time && net start w32time

Implement comprehensive monitoring to track and alert on suspicious time changes for security purposes.

1. Enable advanced audit policies for time changes:

auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable

2. Create a PowerShell monitoring script for real-time alerts:

# Save as TimeChangeMonitor.ps1
$Query = @"

  
    *[System[EventID=1796]]
  

"@

Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent" -Action {
    $Event = Get-WinEvent -FilterXml $Query -MaxEvents 1
    Write-Host "Time change detected at $($Event.TimeCreated)" -ForegroundColor Yellow
    # Add email notification or logging here
}

3. Set up Event Viewer custom view for time changes:
4. In Event Viewer, right-click Custom Views → Create Custom View
5. Select By log → System
6. Enter Event ID 1796 and save as "Time Changes"
7. Configure Group Policy to centralize time change logging:

HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\System\MaxSize = 20971520

Perform deep analysis of time change events for security investigations and compliance reporting.

1. Create a comprehensive PowerShell analysis script:

# TimeChangeForensics.ps1
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1796} -MaxEvents 1000
$Analysis = @()

foreach ($Event in $Events) {
    $xml = [xml]$Event.ToXml()
    $OldTime = [DateTime]$xml.Event.EventData.Data[0].'#text'
    $NewTime = [DateTime]$xml.Event.EventData.Data[1].'#text'
    $TimeDiff = ($NewTime - $OldTime).TotalSeconds
    
    $Analysis += [PSCustomObject]@{
        EventTime = $Event.TimeCreated
        OldTime = $OldTime
        NewTime = $NewTime
        AdjustmentSeconds = $TimeDiff
        AdjustmentType = if ([Math]::Abs($TimeDiff) -gt 300) { "Major" } else { "Minor" }
        UserSID = $Event.UserId
    }
}

$Analysis | Export-Csv -Path "C:\Forensics\TimeChangeAnalysis.csv" -NoTypeInformation
$Analysis | Where-Object AdjustmentType -eq "Major" | Format-Table

2. Correlate with security events for comprehensive analysis:

$TimeChanges = Get-WinEvent -FilterHashtable @{LogName='System'; Id=1796} -MaxEvents 50
$SecurityEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625} -MaxEvents 100

# Cross-reference time changes with logon events
foreach ($TimeChange in $TimeChanges) {
    $Window = $TimeChange.TimeCreated.AddMinutes(-5)..($TimeChange.TimeCreated.AddMinutes(5))
    $RelatedEvents = $SecurityEvents | Where-Object { $_.TimeCreated -ge $Window[0] -and $_.TimeCreated -le $Window[1] }
    if ($RelatedEvents) {
        Write-Host "Time change at $($TimeChange.TimeCreated) correlates with $($RelatedEvents.Count) security events"
    }
}

3. Generate compliance report:

$Report = $Analysis | Group-Object { $_.EventTime.Date } | ForEach-Object {
    [PSCustomObject]@{
        Date = $_.Name
        TotalChanges = $_.Count
        MajorAdjustments = ($_.Group | Where-Object AdjustmentType -eq "Major").Count
        MaxAdjustment = ($_.Group | Measure-Object AdjustmentSeconds -Maximum).Maximum
    }
}

$Report | Export-Csv -Path "C:\Reports\DailyTimeChangeReport.csv" -NoTypeInformation