Why does my server display a different system time in the logs?

As can be seen from the event below the server time is 31/03/2015 10:56:25 AM whereas the systemtime is changed to: 2015-03-30T23:56:25

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          31/03/2015 10:56:25 AM
Event ID:      1
Task Category: None
Level:         Information
Keywords:      Time
User:          LOCAL SERVICE
Computer:      pdcserver.com.au
Description:
The system time has changed to 2015-03-30T23:56:25.441716900Z from 2015-03-30T23:55:55.494787400Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>1</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2015-03-30T23:56:25.442719400Z" />
    <EventRecordID>25692</EventRecordID>
    <Correlation />
    <Execution ProcessID="476" ThreadID="2040" />
    <Channel>System</Channel>
    <Computer>pdcserver.com.au</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="NewTime">2015-03-30T23:56:25.441716900Z</Data>
    <Data Name="OldTime">2015-03-30T23:55:55.494787400Z</Data>
  </EventData>
</Event>

This one might help.

https://social.technet.microsoft.com/forums/windows/en-US/2e215330-4bfa-4d7a-b138-3192794472f3/event-id-1-the-system-time-has-changedto-the-future

or possibly (for domain time)

net stop w32time

w32tm /config /syncfromflags:domhier /update

net start w32time

 

 

 

Hi Dave,

My system time is reported as being 13 hours in the past not the future.

The date & time displayed on the server is correct however the event log contains these items with a strange system time...

Ok, time was only changed 30 seconds. What is the timezone offset where you're located?'

    <Data Name="NewTime">2015-03-30T23:56:25.441716900Z</Data>
    <Data Name="OldTime">2015-03-30T23:55:55.494787400Z</Data>

 

 

Melbourne Australia

+11

http://localtimes.info/Oceania/Australia/Victoria/Melbourne/

Ok, that's what I suspected. The log is reporting UTC time stamps.