Today my AD PDC (all DCs are 2003 servers) went from Jan-20-2010 13:51:32 to May-20-2010 13:51:33 without any reasonable explanation.
At this point, I’ve given up trying to find the culprit (admin user or process).
What I would like to find out is how to capture in the Event Viewer Application or System logs any changes made to my PDC’s Time/Date?
I’ve poked around the Domain Controllers’ GPO setting but can’t seem to find anything relevant.
Has anyone out there implemented a tool or a customization to do this?
