Windows server 2k8 R2 timer change by "User: System" "UserID=S-1-5-18"


  • The Windows server 2k8 R2 is a domain controller & virtual machine reside on ESXi. The setting is Virtual Machine didn't sync time to ESXi host, and ESXi host is also not part of domain.

    Now we found a interesting problem after we manually adjust windows time or running a task to sync domain controller to high level web service inside our system, from event log we can see "User: System"  "UserID=S-1-5-18" change the window timer one more time. The event happen about 20~60min later, everytime it is different on different site. We don't know what trig this event & which task is doing this. Here I attach event log below.


    Log Name:      System
    Source:        Microsoft-Windows-Kernel-General
    Date:          12/07/2011 8:43:38 PM
    Event ID:      1
    Task Category: None
    Level:         Information
    Keywords:      Time
    User:          SYSTEM
    The system time has changed to ‎2011‎-‎07‎-‎12T11:13:38.500000000Z from ‎2011‎-‎07‎-‎12T11:17:57.796875000Z.
    Event Xml:
    <Event xmlns="">
        <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
        <TimeCreated SystemTime="2011-07-12T11:13:38.500000000Z" />
        <Correlation />
        <Execution ProcessID="4" ThreadID="88" />
        <Security UserID="S-1-5-18" />
        <Data Name="NewTime">2011-07-12T11:13:38.500000000Z</Data>
        <Data Name="OldTime">2011-07-12T11:17:57.796875000Z</Data>
    Thursday, July 14, 2011 1:19 AM


All replies