Figure 2: Sample event ID 520

Event Type:	Success Audit
Event Source:	Security
Event Category:	System Event
Event ID:	520
Date:	12/2/2004
Time:	7:42:22 AM
User:	 NT AUTHORITY\SYSTEM
Computer:	DC1
Description:
The system time was changed.
 Process ID:		1560
 Process Name:		C:\Program Files\VMware\VMwareService.exe
 Primary User Name:		DC1$
 Primary Domain:	ACME
 Primary Logon ID:	(0x0,0x3E7)
 Client User Name:	DC1$
 Client Domain:		ACME
 Client Logon ID:	(0x0,0x3E7)
 Previous Time:		7:33:40 AM 12/2/2004
 New Time:		7:42:22 AM 12/2/2004