Windows Event ID 3086 – Microsoft-Windows-Kernel-General: System Time Change Detected

Start by examining the specific details of Event ID 3086 to understand what triggered the time change.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 3086 in the Event IDs field and click OK
5. Double-click on recent Event ID 3086 entries to view details
6. Examine the General tab for old time, new time, and time difference
7. Check the Details tab for additional XML data about the time source

Use PowerShell to query multiple time change events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=3086} -MaxEvents 20 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Check the Windows Time service configuration to ensure proper NTP synchronization settings.

1. Open an elevated Command Prompt or PowerShell
2. Check the current time service status:

w32tm /query /status

3. Review the time source configuration:

w32tm /query /source

4. Check time service configuration details:

w32tm /query /configuration

5. For domain-joined computers, verify domain hierarchy:

w32tm /query /peers

6. Test time synchronization manually:

w32tm /resync /rediscover

7. Check the Windows Time service registry settings at:

HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

Enable detailed time service logging to identify the root cause of frequent time changes.

1. Enable W32Time debug logging by running:

w32tm /debug /enable /file:C:\Windows\Temp\w32time.log /size:10000000 /entries:0-300

2. Monitor the log file for time adjustment events:

Get-Content C:\Windows\Temp\w32time.log -Wait -Tail 20

3. Check the System event log for related W32Time events:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Time-Service'} -MaxEvents 50

4. Review Application and Services Logs for detailed time service information:
5. Navigate to Event Viewer → Applications and Services Logs → Microsoft → Windows → Time-Service
6. Enable Operational and Debug logs if not already active
7. Disable debug logging when finished:

w32tm /debug /disable

Check for hardware-related time issues that might cause frequent system time adjustments.

1. Compare system time with hardware clock:

w32tm /stripchart /computer:time.windows.com /samples:5 /dataonly

2. Check system uptime to correlate with time change events:

Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object LastBootUpTime, LocalDateTime

3. For virtual machines, verify time synchronization settings:

# VMware
Get-Service -Name VMTools
# Hyper-V
Get-VMIntegrationService -VMName $env:COMPUTERNAME -Name "Time Synchronization"

4. Check BIOS/UEFI time settings during next reboot
5. Verify that the hardware clock is set to UTC (recommended) or local time consistently
6. For physical servers, consider CMOS battery replacement if time drift is excessive
7. Review power management settings that might affect hardware clock:

powercfg /query SCHEME_CURRENT SUB_SLEEP

Set up comprehensive monitoring for time-related events to proactively identify and resolve issues.

1. Create a PowerShell script to monitor and alert on excessive time changes:

# TimeChangeMonitor.ps1
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=3086; StartTime=(Get-Date).AddHours(-24)}
foreach ($Event in $Events) {
    $XML = [xml]$Event.ToXml()
    $OldTime = $XML.Event.EventData.Data[0].'#text'
    $NewTime = $XML.Event.EventData.Data[1].'#text'
    Write-Output "Time changed from $OldTime to $NewTime at $($Event.TimeCreated)"
}

2. Set up a scheduled task to run the monitoring script:

$Action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\TimeChangeMonitor.ps1'
$Trigger = New-ScheduledTaskTrigger -Daily -At 9AM
Register-ScheduledTask -TaskName "TimeChangeMonitor" -Action $Action -Trigger $Trigger

3. Configure Windows Event Forwarding for centralized time event collection:
4. On collector server, enable Windows Event Collector service:

wecutil qc

5. Create custom event log views for time-related events:
6. In Event Viewer, create a Custom View with XML filter:

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[EventID=3086 or EventID=1]]</Select>
  </Query>
</QueryList>