Windows Security Log Events by ID: Event ID 520

Windows Security Log Events by ID

look up more events by Event ID or Category

Event ID

520

Title

The system time was changed

Type:

Example:

Randy's Comments:

Success

OS:

Windows 2003

Category:

System Events

The system time was changed.
Process ID:2024
Process Name:C:\WINDOWS\system32\rundll32.exe
Primary User Name:administrator
Primary Domain:ELM
Primary Logon ID:(0x0,0x158EB7)
Client User Name:administrator
Client Domain:ELM
Client Logon ID:(0x0,0x158EB7)
Previous Time:7:09:19 PM 8/5/2004
New Time:7:10:18 PM 8/5/2004

Process Name will usually be rundll32.exe (Control Panel), cmd.exe (Time command) or svchost (if the time was changed by the system in connection with the Windows time synchronization service or NTP). Primary User Name will correspond to the system itself in the latter case. In the former cases, Primary User Name and Client User Name will both indicate the user who changed the time.

New and old times are indicated.

Windows Security Log Events by ID

520

The system time was changed

Upcoming Webinars by Randy Franklin Smith

Additional Links