Windows Security Log Event ID 520
| Operating Systems |
Windows 2003 and XP
|
|
Category | System |
|
Type
|
Success
|
Corresponding events
in Windows
2008
and Vista |
4616
|
520: The system time was changed
On this page
Process name, explained below, indicates how the time was changed.
New and old times are indicated.
Free Security Log Resources by Randy
- Process Name: Path and name of the process that changed the time. Will usually be rundll32.exe (Control Panel), cmd.exe (Time command) or svchost (if the time was changed by the system in connection with the Windows time synchronization service or NTP)
- Primary User Name: Will correspond to local system if changed automatically; otherwise will identify the actual user if changed through control panel or the time command.
- Primary Domain: domain of the user
- Primary Logon ID: correlates to the logon ID in the user's logon session event ID 528 or 540
- Client User Name:
- Client Domain:
- Client Logon ID:
- Previous Time:
- New Time:
Supercharger Enterprise
Load Balancing for Windows Event Collection
The system time was changed.
Process ID:2024
Process Name:C:\WINDOWS\system32\rundll32.exe
Primary User Name:administrator
Primary Domain:ELM
Primary Logon ID:(0x0,0x158EB7)
Client User Name:administrator
Client Domain:ELM
Client Logon ID:(0x0,0x158EB7)
Previous Time:7:09:19 PM 8/5/2004
New Time:7:10:18 PM 8/5/2004
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection