4616 · The system time was changed

01Fields in the event

• SubjectUserSid
• SubjectUserName
• SubjectDomainName
• SubjectLogonId
• PreviousTime
• NewTime
• ProcessId
• ProcessName

02A worked example

Synthetic excerpt of a system time change, shown only to illustrate how the fields are read.

• PreviousTime and NewTime are both in UTC. Here NewTime is three hours earlier than PreviousTime, give or take a fraction of a second, so account s.yildiz set the clock back by three hours at 09:41 UTC.
• The Subject is a named account, not LOCAL SERVICE, and ProcessName is not svchost.exe. Microsoft's monitoring advice lists both as changes to report, because they were not made by the Windows Time service. The event does not say why the time was changed.
• Records from this computer written before the change carry the old clock and records written after it carry the new one; the jump is NewTime minus PreviousTime, about minus three hours here. The event does not tell you which side matches true time, so check against an external reference before placing the two sets on one timeline.
• SubjectLogonId 0x9b3e2 is the key to the session that made the change: search 4624 on the same computer for a TargetLogonId of the same value, before the next reboot. ProcessId 0x1a30 is hexadecimal and can be matched with the New Process ID of a 4688.

03How to use it

Check who changed the time and with which process: SubjectUserName and ProcessName identify them, and SubjectLogonId links the change to the 4624 that opened the session. Microsoft's monitoring advice is to report every change whose Subject is not LOCAL SERVICE and whose process is not svchost.exe, because those changes were not made by the Windows Time service. As a working method, note that the clock jumped by the difference between NewTime and PreviousTime at that moment, and read the records from this computer on either side of the change with that difference in mind.

04Ordinary causes

Microsoft describes entries with LOCAL SERVICE as the Subject as normal time correction actions, and says a change whose Subject is not LOCAL SERVICE, or whose process is not svchost.exe, was not made by the Windows Time service.

05Read it with

• 4624 An account was successfully logged onMicrosoft gives the Logon ID as a value that can be matched with the logon event, to see how the account that changed the time logged on.
• 4688 A new process has been createdMicrosoft says the Process ID of the process that changed the time can be matched with the New Process ID of the process creation event. Process IDs are reused, so match on time as well.

06Caveats

The event is always logged, whatever the Audit Security State Change setting. It shows that the time was changed and by which account and process; it does not show why. ProcessId and ProcessName exist only from event version 1 (Windows Server 2008 R2 and Windows 7); version 0 does not have them.

07Related artifacts, procedures and cases

• Artifact

  Services registry key

• Artifact

  Windows XML Event Log (EVTX)

08Sources

1. Microsoft Learn — 4616(S) The system time was changed ↗checked 2026-10-23