Log Name: System
Source: Microsoft-Windows-Kernel-General
Date: 17/05/2019 1.49.30
Event ID: 1
Task Category: (5)
Level: Information
Keywords: Time
User: N/A
Computer: DESKTOP-GC2PDN0
Description:
The system time has changed to 2019-05-16T22:49:30.500000000Z from 2019-05-16T22:01:57.216728700Z.
Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).
Event Xml:
<Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-General" Guid="{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}" />
<EventID>1</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>5</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2019-05-16T22:49:30.500207000Z" />
<EventRecordID>2994</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="1284" />
<Channel>System</Channel>
<Computer>DESKTOP-GC2PDN0</Computer>
<Security />
</System>
<EventData>
<Data Name="NewTime">2019-05-16T22:49:30.500000000Z</Data>
<Data Name="OldTime">2019-05-16T22:01:57.216728700Z</Data>
<Data Name="Reason">2</Data>
<Data Name="ProcessName">
</Data>
<Data Name="ProcessID">4</Data>
</EventData>
</Event>
Log Name: System
Source: Microsoft-Windows-Power-Troubleshooter
Date: 17/05/2019 1.49.31
Event ID: 1
Task Category: None
Level: Information
Keywords:
User: LOCAL SERVICE
Computer: DESKTOP-GC2PDN0
Description:
The system has returned from a low power state.
Sleep Time: 2019-05-16T22:01:55.750005900Z
Wake Time: 2019-05-16T22:49:31.351953400Z
Wake Source: Timer - Windows will execute 'NT TASK\Microsoft\Windows\UpdateOrchestrator\Reboot' scheduled task that requested waking the computer.
Event Xml:
<Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Power-Troubleshooter" Guid="{cdc05e28-c449-49c6-b9d2-88cf761644df}" />
<EventID>1</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2019-05-16T22:49:31.537475400Z" />
<EventRecordID>2995</EventRecordID>
<Correlation ActivityID="{1965de13-552d-4ef7-b42c-fa42f595882d}" />
<Execution ProcessID="2984" ThreadID="5632" />
<Channel>System</Channel>
<Computer>DESKTOP-GC2PDN0</Computer>
<Security UserID="S-1-5-19" />
</System>
<EventData>
<Data Name="SleepTime">2019-05-16T22:01:55.750005900Z</Data>
<Data Name="WakeTime">2019-05-16T22:49:31.351953400Z</Data>
<Data Name="SleepDuration">535</Data>
<Data Name="WakeDuration">851</Data>
<Data Name="DriverInitDuration">491</Data>
<Data Name="BiosInitDuration">1061</Data>
<Data Name="HiberWriteDuration">0</Data>
<Data Name="HiberReadDuration">0</Data>
<Data Name="HiberPagesWritten">0</Data>
<Data Name="Attributes">1879073024</Data>
<Data Name="TargetState">4</Data>
<Data Name="EffectiveState">4</Data>
<Data Name="WakeSourceType">6</Data>
<Data Name="WakeSourceTextLength">125</Data>
<Data Name="WakeSourceText">Windows will execute 'NT TASK\Microsoft\Windows\UpdateOrchestrator\Reboot' scheduled task that requested waking the computer.</Data>
<Data Name="WakeTimerOwnerLength">52</Data>
<Data Name="WakeTimerContextLength">18</Data>
<Data Name="NoMultiStageResumeReason">0</Data>
<Data Name="WakeTimerOwner">\Device\HarddiskVolume2\Windows\System32\svchost.exe</Data>
<Data Name="WakeTimerContext">SystemEventsBroker</Data>
</EventData>
</Event>