Event ID - 34

Event Id	34
Source	Microsoft-Windows-Time-Service
Description	The time service has detected that the system time needs to be changed by %1 seconds. The time service will not change the system time by more than %2 seconds. Verify that your time and time zone are correct, and that the time source %3 is working properly.
Event Information	According to Microsoft : Cause : This event is logged when the time service has detected that the system time needs to be changed by seconds. Resolution : Correct the time difference to within acceptable thresholds The time source and the local system time are skewed beyond the acceptable thresholds. Resynchronize the time clocks between the two systems. Perform the following procedure on the computer that is logging the event to be resolved. To perform this procedure, you must have membership in Administrators or you must have been delegated the appropriate authority. To resynchronize the time clocks between the time source and the local system clock: Caution : Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data. Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. At the command prompt, type W32TM /resync, and then press ENTER. If resynchronizing the time clocks manually does not resolve the issue, you can adjust the local computer's MaxAllowedPhaseOffset value in the registry under the following path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config. In the Active Directory Domain Services (AD DS) environment, clients are configured to use a setting of 300 seconds (five minutes), which is a default setting that is part of the Kerberos security model. Verify : To perform this procedure, you must have membership in Administrators or you must have been delegated the appropriate authority. To verify that the Windows Time service is synchronizing correctly: Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. At the command prompt, type W32TM /resync, and then press ENTER. At the command prompt, type W32TM /query /status, and then press ENTER. The command displays the status of the Windows Time service synchronization. The Last Successful Sync Time line of the output displays the date and time that you ran the W32TM /resync command in the previous step. Also, check the computer name that is shown as the Source. This should be the name of a domain controller (or administrator-configured time server). To confirm that the Windows Time service was synchronized successfully with its time source when you ran the W32TM /resync command, verify that Event ID 35 appears in the Event Viewer.
Reference Links	Event ID 34 from Source Microsoft-Windows-Time-Service

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught