Re: Auditing system time changes

From: Wesley Vogel (123WVogel955_at_comcast.net)
Date: 10/29/05 

Date: Sat, 29 Oct 2005 13:31:13 -0600

Failed attempts to change the system time may show up as Success 520.

Success 520 shows The system time was changed when you double click the
clock and then close Date and Time Properties without changing anything
whatsoever. 

-- 
Hope this helps.  Let us know.
Wes
MS-MVP Windows Shell/User
In news:242CF1CF-A1D6-478F-BCDD-CFC04C18C267@microsoft.com,
Chris Cooper <ChrisCooper@discussions.microsoft.com> hunted and pecked:
> I need to audit failed attempts to change the system time.  I'm running XP
> Pro (SP2) in a standalone situation.  I have failure auditing of system
> events and of privilege use.  I don't get a 520 event failure or a 577
> SeSystemTimePrivilege failure in the Security Log when unprivileged users
> try to change the system time.
>
> If I turn on success auditing on these two categories, priveleged users do
> generate success audit entries for these two event IDs.
>
> Any help would be greatly appreciated...

Relevant Pages

  • Re: Auditing system time changes
    ... >> Failed attempts to change the system time may show up as Success 520. ... >>> I need to audit failed attempts to change the system time. ... I don't get a 520 event failure or ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Audit time change attempt by users and logging in event viewer
    ... failure attempt by a user. ... When the user tries to change the system time from ... setting auditing on failure to access registry keys I believe have to do ... system time but still NOTHING LOGGED in security event viewer. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Using Pollidle
    ... So I think I will stick with event_process even if this wastes more ... system time. ... I am still investigating the failure I experience which seems to stem from ...
    (comp.sys.acorn.programmer)