System Clock Time Change - Event Tracking

[ebonovich]

Our POS systems have been setup so the user can't change the time.
However, there have been times when the System Clock has been changed.

We would like to track these events.

I found this:
http://www.ultimatewindowssecurity.com/events/com188.html

But it appears to only be availabe for Windows 2003
Is there a similar event on Windows XP (PRO SP2)

Or is there another system event, or something I can "listen" for via a
running background service.

Thanks

 

[Guest]

Event viewer does not appear to log this type of event in Win XP, it does in
Win Server 2003, and that's the only way I know how to do it...others may
know better

You may want to have a look in Local Security policy at who is able to
change the Time/Date.

Let me know if you need help to do this...

 

[Don Taylor]

Our POS systems have been setup so the user can't change the time.
However, there have been times when the System Clock has been changed.

We would like to track these events.

I found this:
http://www.ultimatewindowssecurity.com/events/com188.html

But it appears to only be availabe for Windows 2003
Is there a similar event on Windows XP (PRO SP2)

Or is there another system event, or something I can "listen" for via a
running background service.

Since you are describing listening to events it sounds like you
have some possibility of running your own code on the system.

How about writing a few lines of code, maybe even a simple script,
that just logs the current time into a logfile once every X
seconds/minutes/weeks, choose your frequency to suit your purpose.

Scanning that logfile to spot the sequence not neatly changing
would almost get you loose of all the Windows Internals and make
this a simple user-level problem.