App Control: Computer Security Alert seen in events of console: Computer clock out of sync, Timestamp of events from computer X are Y days in the future.

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Computer Security Alert seen in Protection console indicating : Computer clock out of sync. 
• The events may be seen in the Protection Console with “Unexpected time change”.

Environment

• App Control: All Supported Versions

Cause

• The agent works with endpoint clock, if it changes unexpectedly an alert is raised. However, Protection does not have visibility of the cause of the date/time change cause.
• The agent records the time at startup during health checks and it is in this way that the correct time is obtained. If the start time is greater than the current time an alert is triggered.

Resolution

The issue has to be fixed outside of the Agent. 

• Investigate the System Event Log (Windows) and look for events (including but not limited to) with W32Time or LSASRV as the Source.   
• Also search for Windows Event ID 4616 “The System Time was changed”.

Once the source of the issue is identified (Domain Controller, endpoint, or other), it will need to be fixed from there.