Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Friday, February 12, 2016 12:06 PM | 1 vote
Hi,
I am experiencing a very weird problem with one of my newly installed Windows 10 PCs.
The System Time keeps jumping back to a specifict date / time - which is January 28th 1:02 pm. No Software was installed on that day. The System itself was installed more than 10 days before that.
Windows Version is 10.0.10586 (Pro)
The PC is a member of a domain with an accessible ntp server. Event Log entries show that it syncs with the corret one too.
I have found a lot of posts on the Internet, which mention the CMOS Battery, but that is not it - I cloned the system into a VM and ran that on my Windows 7 PC and the issue still occurred.
The Windows EventLog only shows entries for "Kernel-General" when the time jumps back, which only say "..was changed by a Program or Service", but not which Program or Service initiated the time change.
All the entries before or after the time jump don't seem to have anything to do with it.
I have not found a way to reproduce the problem other than just letting the system sit idle and wait.
Are there any other ways to find which program initiated the time change? Like log files for the time service?
All replies (7)
Tuesday, February 23, 2016 11:52 AM ✅Answered | 1 vote
Issue seems to occur randomly. The eventlog always showed a different time.
w32tm /query /source always shows the correct time server when the client is a domain member
I tried removing the machine from the domain.
At first it showed CMOS-Clock, but then the clock stopped completely and it showed "free-running system clock"
I don't think i can sync with time.windows.com, because we are behind a very restrictive proxy, which we have no administrative access to. Also I don't know what that would help me, since the machine has to be a member of the domain and sync with the DC's time as all the other machines (about 500) do.
Also: On the VM clone I made of the machine - I tried the Windows 10 "Reset this PC" feature and the problem didn't occur after that.
Solving this is not a huge priority, I just want to know how I can combat this, when it happens again on another machine.
Thursday, March 10, 2016 12:47 PM ✅Answered | 1 vote
So, since I encountered this problem multiple times now on different pcs that were just newly installed, I did some more digging, but have still not found what creates the issue.
But at least, I found a way to get rid of it without using the reset feature. I just have to reregister the w32tm service:
net stop w32time
w32tm /unregister
w32tm /register
net start w32time
Saturday, February 13, 2016 8:29 AM | 1 vote
Click on the system clock/date shown in the system tray. On the analog clock/calendar window that shows up, click Change date and time settings.
Click on the Internet Time tab, and then the Change settings button.
Click on the Synchronize with an Internet time server check box, and use the Server drop down menu to choose one of the available Internet Time Servers. You can also use the Update now button to manually synchronize the time.
S.Sengupta, Windows Experience MVP
Monday, February 15, 2016 2:40 AM | 1 vote
Hi ElGimpoGrande,
"which only say "..was changed by a Program or Service"
First of all, we could try to perform a clean boot to troubleshoot whether this issue is related to a third party service.
How to perform a clean boot in Windows
https://support.microsoft.com/en-us/kb/929135
When the system time changing, Event ID "4616" will be recorded. We could try to filter that Event from the "Security" catalog.
4616: The system time was changed
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4616
NOTE: This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites.
Best regards
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].
Tuesday, February 16, 2016 8:45 AM | 1 vote
Click on the system clock/date shown in the system tray. On the analog clock/calendar window that shows up, click Change date and time settings.
Click on the Internet Time tab, and then the Change settings button.
Click on the Synchronize with an Internet time server check box, and use the Server drop down menu to choose one of the available Internet Time Servers. You can also use the Update now button to manually synchronize the time.
S.Sengupta, Windows Experience MVP
Can't do that on a Windows 10 PC with Domain. I use "net time /domain /set /yes" to set the time, when it jumps back.
When the system time changing, Event ID "4616" will be recorded. We could try to filter that Event from the "Security" catalog.
4616: The system time was changed
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4616
Yeah, they are there, but the program listed in that event is svchost.exe, which doesn't help me.
Clean boot btw didn't help either. It didn't deactivate the virus scanner tho, since that has protection.
I uninstalled it right now, will see if that does anything.
EDIT: It's not the virus scanner
Wednesday, February 17, 2016 3:01 AM | 1 vote
Hi ElGimpoGrande,
Did the issue occur randomly or regularly(check the log time)? Are there any other related error messages recorded in the Event Viewer?
If the issue occurred regularly, we could try to use process monitor tool to have a troubleshoot.
I noticed you are using a NTP server. Please run "w32tm /query /source" to verify the NTP source when the issue occurred. If it is possible, please put the machine out of the domain and configure it to sync with the time.windows.com NTP server to have a troubleshoot.
w32tm /config /manualpeerlist:"time.windows.com,0x1" /syncfromflags:manual /reliable:yes /update
w32tm /config /update
net stop w32time && net start w32time
To ensure the safety of the system, please perform a full scan with the antivirus software in safe mode.
Best regards
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].
Wednesday, February 24, 2016 6:12 AM
Hi ElGimpoGrande,
" I tried the Windows 10 "Reset this PC" feature and the problem didn't occur after that."
If resetting the machine will be useful, this issue may be related to a misconfiguration. However, I am glad the issue disappeared after a resetting.
Best regards
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].