none
Windows server 2k8 R2 timer change by "User: System" "UserID=S-1-5-18"

    Question

  • The Windows server 2k8 R2 is a domain controller & virtual machine reside on ESXi. The setting is Virtual Machine didn't sync time to ESXi host, and ESXi host is also not part of domain.

    Now we found a interesting problem after we manually adjust windows time or running a task to sync domain controller to high level web service inside our system, from event log we can see "User: System"  "UserID=S-1-5-18" change the window timer one more time. The event happen about 20~60min later, everytime it is different on different site. We don't know what trig this event & which task is doing this. Here I attach event log below.

     

    Log Name:      System
    Source:        Microsoft-Windows-Kernel-General
    Date:          12/07/2011 8:43:38 PM
    Event ID:      1
    Task Category: None
    Level:         Information
    Keywords:      Time
    User:          SYSTEM
    Computer:      XXXXXXXX.com
    Description:
    The system time has changed to ‎2011‎-‎07‎-‎12T11:13:38.500000000Z from ‎2011‎-‎07‎-‎12T11:17:57.796875000Z.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
        <EventID>1</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2011-07-12T11:13:38.500000000Z" />
        <EventRecordID>2502</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="88" />
        <Channel>System</Channel>
        <Computer> XXXXXXXX.com</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="NewTime">2011-07-12T11:13:38.500000000Z</Data>
        <Data Name="OldTime">2011-07-12T11:17:57.796875000Z</Data>
      </EventData>
    </Event>
    Thursday, July 14, 2011 1:19 AM

Answers

All replies