how can i monitor the system clock in windows for changes, either through the GUI or the command line using the "time" command? I suppose i need to turn on auditing, but which event ID should i look at? thanks
SirDice is right, the SE_SYSTEMTIME_NAME privilege in windows is disabled by default for most users. But I'm guessing that if you check out more about how the time in windows is controled you could come up with a solution.
Here are some pages that may help you get started. (this is for windows)