Step 1: Enable GPO Auditing

Launch the 'Server Manager' and open the Group Policy Management Console (GPMC).

In the left pane, expand the 'Forest' and 'Domains' nodes to reveal the specified domain you want to track the changes for.

Expand the domain and right-click 'Default Domain Policy'. You can also choose a domain policy that is universal throughout the domain, or create a new GPO and link it to the Default Domain Policy.

Click on 'Edit' of the desired group policy, to open up the Group Policy Management Editor.

Expand 'Computer Configuration'--->Policies---->Windows Settings----->Security Settings----->Advanced Policy Configurations----->Audit Policy------>Systems-----Other system events.

Enable audit for 'success' and 'failure' events. Exit the Group Policy Management

In the GPMC, choose the modified GPO, and click 'Add' in the 'Security' section on the right pane. Type 'everyone' in the text box and click 'Check Names' to include the value. Exit the GPMC.

To enforce these changes throughout the domain, run the command 'gupdate /force', in the "Run" console.

Step 2: Allow AD Auditing through ADSI Edit

From your 'Server Manager' go to 'Tools' and select 'ADSI Edit'.

Right click 'ADSI Edit' node from the left pane and select 'Connect to' option. This pulls up the 'Connection Settings' window.

Select the 'Default Naming Context' option from the 'Select a well-known Naming Context' drop down list.

Click 'Okay' and return to the ADSI Edit window. Expand 'Default Naming Context' and select the associated 'DC' subnode. Right-click this subnode and click 'Properties'.

In the 'Properties' window, go to the 'Security' tab and select 'Advanced'. After that select 'Auditing' tab and click 'Add'.

Click on ' Select a principle'. This will bring up a 'Select User, Computer or Group' Window. Type 'Everyone' in the textbox and verify it with 'Check Names'.

The 'Principle' in the 'Auditing Entry' window now shows 'Everyone'. In the 'Type' drop-down select 'All' to audit for both 'success' and 'failure' events.

In the 'Select' drop-down choose 'This object and all descendant object's. Select 'Full Control' in the 'Permissions' section.

This selects all the checkboxes available. Unselect the following check boxes:

1. Full Control

2. List Contents

3. Read all properties

4. Read permissions

Step 3: View Events in Event Viewer

You can view events by accessing 'Security Logs' in the 'Event Viewer'. You can filter your log to look for the following event.

Event ID: 4616 describes an event where the system time was changed.