Who changes the time? - windows

Question

I am aware of the WM_TIMECHANGE message in the Win32 API, but is it possible to find out which application or process is changing the time?
I have an application (Windows XP) where I'm logging events and the time logged with the events is changing unexpectedly.
I have already checked: Daylight Savings adjustment is turned off, and automatic syncing with an internet time server is also turned off.
Is there a process in the Windows OS (except for DST changes and NTP) that could set the system time?

Answer 1

Time changes are saved to the Windows Event Log, specifically, they're saved to the security log. Now, this isn't guaranteed to work; admins can clear the security log, but it's a way to find the PID and the file name of the process that called SetSystemTime.
This answer talks about finding the event in the System log; however, you should also be able to find it in the Security log by looking for event ID 4616. I've added a sample record here (with various bits redacted):
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4616</EventID>
<Version>1</Version>
<Level>0</Level>
<Task>12288</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2013-10-07T18:55:08.999738200Z" />
<EventRecordID>29419283</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="5460" />
<Channel>Security</Channel>
<Computer>some computer ID</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-SID_REDACTED</Data>
<Data Name="SubjectUserName">UserName</Data>
<Data Name="SubjectDomainName">DOMAIN</Data>
<Data Name="SubjectLogonId">0xBADDFOOD</Data>
<Data Name="PreviousTime">2013-10-07T18:55:08.996254000Z</Data>
<Data Name="NewTime">2013-10-07T18:55:09.000000000Z</Data>
<Data Name="ProcessId">0xPID</Data>
<Data Name="ProcessName">C:\Windows\System32\dllhost.exe</Data>
</EventData>
</Event>
Note that the process name is stored explicitly.