Windows Security Log Event ID 520

Operating Systems Windows 2003 and XP
Type Success
Corresponding events
in Windows 2008
and Vista

520: The system time was changed

On this page

Process name, explained below, indicates how the time was changed. 

New and old times are indicated.

Free Security Log Resources by Randy

Description Fields in 520

  • Process Name: Path and name of the process that changed the time.  Will usually be rundll32.exe (Control Panel), cmd.exe (Time command) or svchost (if the time was changed by the system in connection with the Windows time synchronization service or NTP)
  • Primary User Name: Will correspond to local system if changed automatically; otherwise will identify the actual user if changed through control panel or the time command.
  • Primary Domain: domain of the user
  • Primary Logon ID: correlates to the logon ID in the user's logon session event ID 528 or 540
  • Client User Name:
  • Client Domain:
  • Client Logon ID:
  • Previous Time:
  • New Time:

Setup PowerShell Audit Log Forwarding in 4 Minutes


Examples of 520

The system time was changed.
Process ID:2024
Process Name:C:\WINDOWS\system32\rundll32.exe
Primary User Name:administrator
Primary Domain:ELM
Primary Logon ID:(0x0,0x158EB7)
Client User Name:administrator
Client Domain:ELM
Client Logon ID:(0x0,0x158EB7)
Previous Time:7:09:19 PM 8/5/2004
New Time:7:10:18 PM 8/5/2004

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources