I can’t always answer e-mails for help through this blog (I simply don’t have the time) but, a few days ago, I received an e-mail from a reader with a question that intrigued me – at what time did Windows update the system clock when British Summer Time ended last weekend? I knew that the official end time was 02:00 (and it’s 01:00 when the clocks go forward again in the spring) but there was nothing in the logs to indicate the time when Windows applied the changes.
After a bit of research I found that this information is written to the registry when the time zone is selected at setup time, or via the Control Panel date and time applet. On my Windows Server 2008 system,
reg query hklm\system\currentcontrolset\control\timezoneinformation returned:
Bias REG_DWORD 0×0
DaylightBias REG_DWORD 0xffffffc4
DaylightName REG_SZ @tzres.dll,-261
DaylightStart REG_BINARY 00000300050001000000000000000000
DynamicDaylightTimeDisabled REG_DWORD 0×0
StandardBias REG_DWORD 0×0
StandardName EG_SZ @tzres.dll,-262
StandardStart EG_BINARY 00000A00050002000000000000000000
TimeZoneKeyName REG_SZ GMT Standard Time
ActiveTimeBias REG_DWORD 0×0
It’s the daylightstart and standardstart values that are of interest here –
reg query hklm\system\currentcontrolset\control\timezoneinformation /v daylightstart returns:
daylightstart REG_BINARY 00000300050001000000000000000000
reg query hklm\system\currentcontrolset\control\timezoneinformation /v standardstart shows:
standardstart REG_BINARY 00000A00050002000000000000000000
Although I can’t work out the format of the binary data, I can see the differences. Ignoring the second 8 bytes (which is all zero) I can see that the differences are:
00 00 03 00 05 00 01 00
00 00 0A 00 05 00 02 00
That looks to me like 03 might be March and 0A (decimal 10) might be October, whilst and 01 may represent 1am in which case 02 would be 2am.
There’s also some more information in Microsoft knowledge base article 914387 including a link to the Windows Time Zone Editor (
tzedit.exe) utility that is used to create timezones (as well as to another utility for combing event logs). The Windows Time Zone Editor is written for Windows 2000 and I’ve not been able to get the resulting time zone that I defined to load on my 64-bit copy of Windows Server 2008 in order to work out the resulting registry changes but I’m pretty sure that the 05 in the registry values for daylightstart and standardstart represents the last day (the options are 1st, 2nd, 3rd, 4th and last) and that one of the 00s is Sunday. One thing that it does do is to confirm that daylight saving for Greenwich Mean Time (British Summer Time) starts on the last Sunday of March at 01:00 and ends on the last Sunday in October at 02:00 – as shown in the accompanying image.
If anyone knows any more about the bytes I haven’t tracked down yet, I’d be pleased to hear your comments!