detection.wiki

Microsoft-Windows-Time-Service › Event 260

Event ID 260 — W32time Service periodic configuration and status message.

Provider
Microsoft-Windows-Time-Service
Channel
Operational
Level
Informational

Description

W32time Service periodic configuration and status message.

Message #

W32time Service periodic configuration and status message
Configuration:
%1
Time Providers:
%2
Current Status:
Leap Indicator: %3
Stratum: %4
Precision: %5
RootDelay: %6
RootDispersion: %7
ReferenceId: %8
Last Successful Sync Time: %9 (UTC)
Source: %10
Poll Interval: %11
Phase Offset: %12
Clock Rate: %13
State Machine: %14
Time Source Flags: %15
Server Role: %16
Last Sync Error: %17
Time Since Last Good Sync: %18
System Tick Count: %19
For more information, see https://go.microsoft.com/fwlink/?linkid=845961.

Fields #

NameDescription
Name—
Configuration UnicodeString—
TimeProviders UnicodeString—
LeapIndicator UInt64—
Stratum UInt64—
Precision UnicodeString—
RootDelay UnicodeString—
RootDispersion UnicodeString—
ReferenceId UnicodeString—
LastSuccessfulSyncTime UnicodeString—
Source UnicodeString—
PollInterval UInt64—
PhaseOffset UnicodeString—
ClockRate UInt64—
StateMachine UInt64—
TimeSourceFlags UInt64—
ServerRole UInt64—
LastSyncError UInt64—
TimeSinceLastGoodSync UnicodeString—
TickCount UInt64—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Time-Service",
    "guid": "06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB",
    "event_source_name": "",
    "event_id": 260,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2022-04-07T17:03:12.815732+00:00",
    "event_record_id": 56,
    "correlation": {},
    "execution": {
      "process_id": 384,
      "thread_id": 4252
    },
    "channel": "Microsoft-Windows-Time-Service/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "Name": "TMP_OPS_PERIODIC_CONFIG_STATUS",
    "Configuration": "EventLogFlags: 2 (Local)\nAnnounceFlags: 10 (Local)\nTimeJumpAuditOffset: 28800 (Local)\nMinPollInterval: 6 (Local)\nMaxPollInterval: 10 (Local)\nMaxNegPhaseCorrection: 172800 (Local)\nMaxPosPhaseCorrection: 172800 (Local)\nMaxAllowedPhaseOffset: 300 (Local)\n\nFrequencyCorrectRate: 4 (Local)\nPollAdjustFactor: 5 (Local)\nLargePhaseOffset: 50000000 (Local)\nSpikeWatchPeriod: 900 (Local)\nLocalClockDispersion: 10 (Local)\nHoldPeriod: 5 (Local)\nPhaseCorrectRate: 7 (Local)\nUpdateInterval: 100 (Local)\n\nFileLogName:  (Undefined or not used)\nFileLogEntries:  (Undefined or not used)\nFileLogSize: 0 (Undefined or not used)\nFileLogFlags: 0 (Undefined or not used)\n\nUtilizeSslTimeData: 1 (Local)\n\n[Leap Seconds]\nEnabled: 1 (Local)\nTotal Leap Seconds (after June 2018): 0 (Local)\nCurrent UTC offset: 0 (Local)\n",
    "TimeProviders": "NtpClient (Local)\nDllName: C:\\Windows\\system32\\w32time.dll (Local)\nEnabled: 1 (Local)\nInputProvider: 1 (Local)\nCrossSiteSyncFlags: 2 (Local)\nAllowNonstandardModeCombinations: 1 (Local)\nResolvePeerBackoffMinutes: 15 (Local)\nResolvePeerBackoffMaxTimes: 7 (Local)\nCompatibilityFlags: 2147483648 (Local)\nEventLogFlags: 1 (Local)\nLargeSampleSkew: 3 (Local)\nSpecialPollInterval: 1024 (Local)\nType: NT5DS (Local)\nNtpServer:  (Undefined or not used)\n\nNtpServer (Local)\nDllName: C:\\Windows\\system32\\w32time.dll (Local)\nEnabled: 1 (Local)\nInputProvider: 0 (Local)\nAllowNonstandardModeCombinations: 1 (Local)\nEventLogFlags: 0 (Undefined or not used)\n\nVMICTimeProvider (Local)\nDllName: C:\\Windows\\System32\\vmictimeprovider.dll (Local)\nEnabled: 1 (Local)\nInputProvider: 1 (Local)\n\n\n",
    "LeapIndicator": 0,
    "Stratum": 1,
    "Precision": "-23",
    "RootDelay": "0.0000000s",
    "RootDispersion": "10.0000000s",
    "ReferenceId": "0x4C4F434C",
    "LastSuccessfulSyncTime": "2022-04-07T16:53:20.718Z",
    "Source": "Local CMOS Clock",
    "PollInterval": 6,
    "PhaseOffset": "0.0000000s",
    "ClockRate": 156250,
    "StateMachine": 0,
    "TimeSourceFlags": 0,
    "ServerRole": 576,
    "LastSyncError": 1,
    "TimeSinceLastGoodSync": "592.0843097s",
    "TickCount": 639843
  },
  "message": ""
}

References #