none
Time Zone changed on a Windows server RRS feed

  • Question

  • Hi,

    Recently we had an issue whereby the time zone was found to be changed on some Windows server.

    Have already checked on the security logs for Event ID 4616, it is there but it does not have any specific details on from which ID the Time zone was changed.

    Is there any way to determine the Time zone was changed by which user ID or any specific system process?

    Thanks in advance,

    Friday, November 17, 2017 7:30 AM

All replies

  • Hi,
    As far as I know, there is a section “security ID” in the event 4616, it should display the user account who change the time zone, did you see that? 
    And if not, could you please post us the screenshot of the event which you see, here is the details of event 4616, you could see more details:
    In addition, you could use policy “change the system time” under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment to restrict specific users change system time. 
    Best regards, 
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, November 20, 2017 2:43 AM
    Moderator
  • 

    Hi,

    I am checking how the issue is going, if you still have any questions, please feel free to contact us.

    And if the replies as above are helpful, we would appreciate you to mark them as answers, and if you resolve it using your own solution, please share your experience and solution here. It will be greatly helpful to others who have the same question.

    Appreciate for your feedback.

    Best regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 22, 2017 8:00 AM
    Moderator
  • Hi,

    Just checking in to see if the information provided was helpful. And if the replies as above are helpful, we would appreciate you to mark them as answers, please let us know if you would like further assistance.

    Best Regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, November 24, 2017 8:58 AM
    Moderator
  • Hi,

    Since the thread is quite for days, can we think that it is fixed? If that is the case, please "mark it as answer" to help other community members find the helpful reply quickly. And we’d love to hear your feedback about the solution if you solve it by own method.

    Thanks for your understanding and efforts.

    Best regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, November 27, 2017 7:56 AM
    Moderator
  • Try searching for event ID 1 in event Log Category "System" instead of "Security". 

    Tuesday, October 15, 2019 5:04 AM