Windows Event Log, System Time Modification

Windows Event ID 4616 within the Security log is generated when the system time is modified. This log contains key information for investigators:

• The original system time
• The modified system time
• The username of the account responsible for the change