tracking system date changes

[n514bm]

I have a internal security issue. Is there any tracking records recorded in xp when a user changes the system date?? I need to see if a user is reverting the system to a earlier date to falsify records then resetting it back to the current date.

Thanks for the help.

[iamtheky]

http://128.175.24.251/forensics/timechange.htm