- Free Edition
- Quick Links
- Active Directory Auditing
- Active Directory auditor
- Active Directory monitoring
- Account lockout analyzer
- Login monitoring software
- Active Directory change notifier
- User logon audit reports
- AD logon logoff tracker
- User logon failure auditing
- Login history tracking tool
- AD change auditor
- Insider threat detection software
- Permissions change auditing
- Entra ID reporting
- Privileged user monitoring
- User behavior analytics tool
- Active Directory security monitoring
- Group Policy auditing tool
- GPO change auditor
- Entra ID auditing
- Audit user account management
- OU change auditor
- Audit group membership changes
- Active Directory auditing and reporting tool
- GPO reporting tool
- Remote desktop monitoring software
- PowerShell logging and auditing
- Azure password protection auditing
- Azure sign-in risk detection
- File Server Auditing
- Windows Server Auditing
- Employee Tracking
- Workstations Auditing
- Compliance Auditing
- Other features
- SIEM Integration
- Windows DNS - Schema Auditing
- Windows security event log monitoring
- SIEM audit solution
- Schedule Active Directory change reports
- Reports from Archived Data
- Aggregated summary reports
- AD new/old attribute changes
- Audit trail
- Audit Active Directory LAPS
- Scheduled Reports & Alerts
- Account lockout examiner
- Industry
- Documents
- Success Stories
- Related Products
- Log360 (On-Premise | Cloud) Comprehensive SIEM and UEBA
- ADManager Plus Active Directory Management & Reporting
- EventLog Analyzer Real-time Log Analysis & Reporting
- ADSelfService Plus Identity security with MFA, SSO, and SSPR
- DataSecurity Plus File server auditing & data discovery
- Exchange Reporter Plus Exchange Server Auditing & Reporting
- M365 Manager Plus Microsoft 365 Management & Reporting Tool
- RecoveryManager Plus Enterprise backup and recovery tool
- SharePoint Manager Plus SharePoint Reporting and Auditing
- AD360 Integrated Identity & Access Management
- AD Free Tools Active Directory FREE Tools
Windows Event ID Event ID 4616: The system time was changed.
| Description | The system time has been changed. The event describes the old and new time. |
| Category | System |
The event logs the following information:
| Process ID | Unique identifier of the process. |
| Process name | Path and name of the process that changed the time. Will usually be rundll32.exe (Control Panel), cmd.exe (Time command) or svchost (if the time was changed by the system in connection with the Windows time synchronization service or NTP) |
| Primary user name | Will correspond to local system if changed automatically; otherwise will identify the actual user if changed through control panel or the time command. |
| Primary domain | Domain of the user. |
| Primary logon ID | Logon ID of the user that correlates to the logon ID in the user's logon session (event ID 528 or 540) |
| Client user name | The user name of the user who changed the time |
| Client domain | The domain to which the client user belongs to. |
| Client logon ID | Logon ID of the user that changed the time. |
| Previous time | Time before the event occurred. |
| New time | Time after the event occurred. |
Pro tip:
- ADAudit Plus can collect these logs in real time and thus lets you know whenever any change in system time occurs.
- ADAudit plus also has features that can alert you via E-mail or SMS when system time has been changed.
- The intuitive reports generated by ADAudit Plus let you know who changed the system time, when it was changed and on which machine it was changed.
Event 4616 applies to the following operating systems:
- Windows 2008 R2 and 7
- Windows 2012 R2 and 8.1
- Windows 2016 and 10
Corresponding event ID for 4774 in Windows Server 2003 and older is 678
Corresponding event in Windows Server 2003 and earlier versions - Event 520