Windows Event ID 2101 – Microsoft-Windows-Kernel-General: System Time Change Detected

Start by examining the specific details of Event ID 2101 to understand what triggered the time change.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 2101 by right-clicking System → Filter Current Log → enter 2101 in Event IDs field
4. Double-click the most recent Event ID 2101 to view details
5. Review the General tab for old time, new time, and time differential
6. Check the Details tab for the process name that initiated the change
7. Note the Source field to identify if the change was user-initiated or system-initiated

Use PowerShell for bulk analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=2101} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Investigate the Windows Time service configuration to determine if automatic synchronization is causing the time changes.

1. Check Windows Time service status:

Get-Service W32Time | Format-List *
w32tm /query /status

2. Review time synchronization configuration:

w32tm /query /configuration
w32tm /query /peers

3. Check time synchronization sources in registry:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" | Select-Object NtpServer, Type

4. For domain-joined computers, verify domain controller time sync:

w32tm /monitor /domain
w32tm /query /source

5. Test manual synchronization to identify issues:

w32tm /resync /force

Cross-reference Event ID 2101 with other system events to identify the root cause and assess security implications.

1. Check for related security events around the same timeframe:

$TimeChange = Get-WinEvent -FilterHashtable @{LogName='System'; Id=2101} -MaxEvents 1
$StartTime = $TimeChange.TimeCreated.AddMinutes(-10)
$EndTime = $TimeChange.TimeCreated.AddMinutes(10)
Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$StartTime; EndTime=$EndTime; Id=4624,4625,4648} | Format-Table TimeCreated, Id, Message

2. Look for application errors related to time synchronization:

Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=$StartTime; EndTime=$EndTime; Level=2,3} | Where-Object {$_.Message -like "*time*" -or $_.Message -like "*clock*"}

3. Check for Group Policy events that might enforce time settings:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503} -MaxEvents 20

4. Review Task Scheduler logs for automated time-related tasks:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TaskScheduler/Operational'; StartTime=$StartTime; EndTime=$EndTime}

5. Export comprehensive time change analysis:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=2101} -MaxEvents 100
$Events | Export-Csv -Path "C:\Temp\TimeChangeAnalysis.csv" -NoTypeInformation

Implement proactive monitoring to detect and alert on unexpected time changes for security and compliance purposes.

1. Create a custom Event Viewer view for time monitoring:

In Event Viewer → Custom Views → Create Custom View:

• Event level: Information, Warning, Error
• Event logs: System, Security
• Event IDs: 2101, 4616, 1
• Save as "Time Change Monitoring"

2. Set up PowerShell-based monitoring script:

# Save as TimeChangeMonitor.ps1
$LastCheck = (Get-Date).AddHours(-1)
$TimeChanges = Get-WinEvent -FilterHashtable @{LogName='System'; Id=2101; StartTime=$LastCheck}
if ($TimeChanges) {
    foreach ($Event in $TimeChanges) {
        $Message = "Time change detected at $($Event.TimeCreated): $($Event.Message)"
        Write-EventLog -LogName Application -Source "TimeMonitor" -EventId 9001 -EntryType Warning -Message $Message
        # Add email notification or SIEM integration here
    }
}

3. Configure Windows Task Scheduler to run monitoring script:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\TimeChangeMonitor.ps1"
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "TimeChangeMonitor" -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest

4. Create registry monitoring for time service changes:

$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters"
$Baseline = Get-ItemProperty -Path $RegPath | ConvertTo-Json
$Baseline | Out-File -FilePath "C:\Temp\W32TimeBaseline.json"

Configure advanced time security measures to prevent unauthorized time changes and ensure compliance with security frameworks.

1. Restrict time change permissions using Group Policy:

Navigate to Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment:

• Modify "Change the system time" policy
• Remove "Users" group, keep only "Administrators" and "LOCAL SERVICE"

2. Configure secure time source hierarchy via Group Policy:

In Computer Configuration → Administrative Templates → System → Windows Time Service:

• Enable "Configure Windows NTP Client"
• Set NtpServer to trusted sources: time.nist.gov,0x1 pool.ntp.org,0x1
• Enable "Enable Windows NTP Server" on domain controllers only

3. Implement time tampering detection registry settings:

# Enable detailed time service logging
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config" -Name "EventLogFlags" -Value 3
# Configure maximum allowed time adjustment
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config" -Name "MaxAllowedPhaseOffset" -Value 300

4. Set up automated compliance reporting:

# Create compliance report for time changes
$Report = @()
$TimeEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=2101} -MaxEvents 100
foreach ($Event in $TimeEvents) {
    $Report += [PSCustomObject]@{
        Timestamp = $Event.TimeCreated
        EventID = $Event.Id
        Source = $Event.ProviderName
        Message = $Event.Message
        UserSID = $Event.UserId
    }
}
$Report | Export-Csv -Path "C:\Compliance\TimeChangeReport_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

5. Configure Windows Event Forwarding for centralized monitoring:

# On collector server
wecutil qc /q
# Create subscription for time events
$SubscriptionXML = @"
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>TimeChangeCollection</SubscriptionId>
    <Query><![CDATA[<QueryList><Query Id="0"><Select Path="System">*[System[EventID=2101]]</Select></Query></QueryList>]]></Query>
</Subscription>
"@
$SubscriptionXML | Out-File -FilePath "C:\Temp\TimeSubscription.xml"
wecutil cs "C:\Temp\TimeSubscription.xml"