Time Change Event 520

[ebonovich]

On our POS systems, our users are blocked from the traditional methods of
changing the clock.
However, there have been times that the clock has changed.

So we want to start tracking when the clock has been changed.
After some research, we have found this:
Windows Security Log Event: 520 The system time was changed
http://www.ultimatewindowssecurity.com/events/com188.html

However, it only appears to be for Windows 2003

Is there a resource kit, or a way that we can get this event into Windows XP
Pro (SP2)
If not, is there a system "event" that we can trap via a service running in
the background.

Thanks

 

[Steven L Umbach]

You could enable auditing of privilege use for success that should show on
the computer when the system time was changed and by who. You would want to
look for SeSystemtimePrivilege . You can use the free Event Comb from
Microsoft to scan the security logs for specific events and text strings
[like SeSystemtimePrivilege] that can help you quickly find pertinent
events. Also make sure the size of the security log is increased quite a bit
from default which can be done via Group Policy. --- Steve