Event ID 4616: The system time was changed
Written when the system clock is changed.
- Log
- Security
- Category
- Defense evasion
Why it matters
- Normal time sync changes come from the Windows Time service by small amounts.
- Large manual changes can confuse log timelines and break Kerberos, which tolerates only five minutes of clock difference by default.
What to check
Check the Process Name and the size of the change.
How to turn it on
Advanced Audit Policy: System > Audit Security State Change.