Windows Event ID 4097 – Microsoft-Windows-Kernel-General: System Time Change Detected

Navigate to Event Viewer to examine the specific time change details and identify the source process.

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4097 in the Event IDs field and click OK
5. Double-click the most recent Event ID 4097 entry
6. Review the General tab for previous time, new time, and process information
7. Check the Details tab for additional XML data including process ID
8. Note the time difference magnitude to determine if the change was significant

Use PowerShell to retrieve and analyze Event ID 4097 entries for patterns and frequency.

1. Open PowerShell as Administrator
2. Run the following command to get recent time change events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=4097} -MaxEvents 20 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

3. For detailed analysis of time changes in the last 24 hours:

$StartTime = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=4097; StartTime=$StartTime} | ForEach-Object {
    $Event = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        PreviousTime = $Event.Event.EventData.Data[0].'#text'
        NewTime = $Event.Event.EventData.Data[1].'#text'
        ProcessId = $Event.Event.EventData.Data[2].'#text'
    }
} | Format-Table -AutoSize

4. Export results to CSV for further analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=4097} -MaxEvents 100 | Export-Csv -Path "C:\Temp\TimeChanges.csv" -NoTypeInformation

Examine Windows Time Service settings to understand automatic time synchronization behavior.

1. Check current time service status:

w32tm /query /status /verbose

2. Review time service configuration:

w32tm /query /configuration

3. Check time synchronization sources:

w32tm /query /peers

4. Examine registry settings for time service:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters"

5. For domain members, verify domain hierarchy:

w32tm /query /source

6. Test time synchronization manually:

w32tm /resync /rediscover

Identify specific processes responsible for time changes using advanced event correlation.

1. Create a PowerShell script to monitor time changes with process details:

$Query = @"

  
    *[System[EventID=4097]]
  

"@

Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent" -Action {
    Get-WinEvent -FilterXml $Query -MaxEvents 1 | ForEach-Object {
        $Event = [xml]$_.ToXml()
        $ProcessId = $Event.Event.EventData.Data[2].'#text'
        $Process = Get-Process -Id $ProcessId -ErrorAction SilentlyContinue
        Write-Host "Time changed by Process: $($Process.ProcessName) (PID: $ProcessId)"
    }
}

2. Check for common time-changing processes:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=4097} -MaxEvents 50 | ForEach-Object {
    $Event = [xml]$_.ToXml()
    $ProcessId = $Event.Event.EventData.Data[2].'#text'
    try {
        $Process = Get-Process -Id $ProcessId -ErrorAction Stop
        $Process.ProcessName
    } catch {
        "Process $ProcessId (no longer running)"
    }
} | Group-Object | Sort-Object Count -Descending

3. Investigate suspicious processes by checking their file locations:

Get-Process | Where-Object {$_.ProcessName -match "time|clock|sync"} | Select-Object ProcessName, Id, Path, StartTime

Implement enhanced monitoring and alerting for unauthorized time changes.

1. Enable detailed time service logging in registry:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Config" -Name "EventLogFlags" -Value 3 -Type DWord

2. Create a scheduled task to monitor time changes:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-WinEvent -FilterHashtable @{LogName='System'; Id=4097} -MaxEvents 1 | Out-File C:\Logs\TimeChange.log -Append"
$Trigger = New-ScheduledTaskTrigger -AtStartup
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "TimeChangeMonitor" -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest

3. Set up Event Viewer custom view for time changes:

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[EventID=4097]]</Select>
  </Query>
</QueryList>

4. Configure Group Policy for time change restrictions (domain environments):
5. Navigate to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
6. Modify Change the system time policy to restrict unauthorized users
7. Apply the policy and run gpupdate /force on target systems