Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 50 Source: Microsoft-Windows-Time-Service

Level
Description
The time service detected a time difference of greater than 128 milliseconds for 90 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider the time service will correct itself.
Comments
 
EV100560 (Time configuration in a Windows Domain) and EV100561 (Configuring the Windows Time Service in an Active Directory Forest) provide an introduction on how to configure and manage time sources in a domain.
From a support forum:
Make sure that no firewall blocks port 123 udp so it can connect to an available DC for time sync. Please run the following command on the server to resync:

w32tm /config /syncfromflags:domhier /update

After that you have to run:

net stop w32time
net start w32time
From a support forum:
Usually the domain controller that holds the PDC emulator role holds also the time setting for the whole domain. If you want to make some adjustments check ME816042.

Try configuring a different time source. For a list of time servers available on the internet go to ME262680.
According to T756549, this indicates that the Windows Time service received inconsistent time data, which resulted in a large time change. This event can indicate an unreliable time source, network connectivity issues, latency with the time source clock, or a hardware malfunction. Verify the time sources, see the article for details.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...