Event ID 4616 — System time change

system time has been changed.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• NTP Synchronization or Correction
• Administrative action
• Modification that may alter the timeline of the logs

Verifications to be carried out

1. Compare Previous Time and New Time
2. Identify process and account
3. Check the NTP source

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4616} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.