System Time Change

If any virtual machine generates this issue so please ensure that integeration services are up to date,
Otherwise Check the time in your BIOS. Hardware time will throw the OS off. It may be what is causing Windows to change its time back.

No, this is not a virtual machine...

Did you see this thing in that machine's log as well ?

Yes. There is an event from Kernel-General

What else can potentially trigger the time reset?

One thing which you should do is to check when it happens, if it happens on OS startup so may be some startup service doing this.

This problem is very frequent and can have many causes, not all of them are known.

You already did the obvious, which is replacing the on-board battery, so only unobvious reasons remain. Some I can think of are :

1Your time-server is bad, so change the one you are using by right-click on the clock / Adjust date/time / Internet Time / Change settings.
2.Check the date/time of your router - sometimes this affects Windows.
3. Select correct timezone in date and time settings.
4. Boot with safemod and check logs again.
5.Reinstall Windows - this was the only solution for some people to undo the corruption.

My question is: which Windows service/process can trigger the time change?

There are many of them, can't simply point out one from them, you have to figure it out step by step

Is the Windows Time Service running?
 
If you want to confirm the root cause, please enable the W32Time service log or enable "Audit Privilege Use" locally with gpedit.msc. For more information, please refer to the following links:
 
How to turn on debug logging in the Windows Time Service
http://support.microsoft.com/kb/816043 
 
Audit privilege use
http://technet.microsoft.com/en-us/library/cc784501(WS.10).aspx 
 
In the meantime, you can use the following commands to disable Windows Time Service.
 
net stop W32Time
sc config W32Time start= disabled
 
You can also remove the service from registry to check the results. Please be sure to back up first.
 
Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time

where are your system getting their time from--you say you disabled Windows Time Service but all system must get time from somewhere--please type
net time
from a comand prompt and let us know what that says

if the system time keeps changing that means that the time source that its pulling it from is changing.

Is the machine domain joined
what does the following cmd show

 w32tm /query /source

if its domain joined it should show a domain controller and you then need to check what is happening that as it will affect all other members of the domain

We do not use windows time service as it is not accurate at all.

Instead, we make use of NTP time server in our geological area. Details are in the link below.

http://www.pool.ntp.org/zh/use.html

Windows Time is disabled and the Net Time command produced the following
"could not locate time server"

And it is a stand alone server.

Standalone server without internet connection?

If it is the case, you need to manually check and correct the time from time to time.

you can make windows time accurate by making sure you DC's pull from a reliable source and then use the windows time service to push it out, using the settings to control it.

If you have no internet connection and no other source to pull it form then the system clock from the bios/motherboard is playing up and changing the time.
If its only by MS and not minutes or hours then its not a massive problem

Did you say this is a server w/o internet connection? If it doesn't then it will get its time from the system itself--you may have to change the CMOS battery.

We do not use windows time service as it is not accurate at all.

How accurate do you need it to be? Kerberos gets along just fine as long as everything is within five minutes (by default - that value can be changed).

Most environments don't need high-precision time synchronization, but if you're running something that does (if you're NASDAQ, for example), then you're correct: the Windows Time service isn't designed for that. Disabling the Windows Time service is only part of the solution, though; you'll also need to install and run a third-party time-sync app. The KB article at the link above contains another link to a list of these apps.

We do not use windows time service as it is not accurate at all.

How accurate do you need it to be? Kerberos gets along just fine as long as everything is within five minutes (by default - that value can be changed).

Most environments don't need high-precision time synchronization, but if you're running something that does (if you're NASDAQ, for example), then you're correct: the Windows Time service isn't designed for that. Disabling the Windows Time service is only part of the solution, though; you'll also need to install and run a third-party time-sync app. The article above contains a link to a list of these apps.

The server is connected to the Internet.

So, where in the OS does this (time-checking-correction) is defined?