I can’t always answer e-mails for help through this blog (I simply don’t have the time) but, a few days ago, I received an e-mail from a reader with a question that intrigued me – at what time did Windows update the system clock when British Summer Time ended last weekend? I knew that the official end time was 02:00 (and it’s 01:00 when the clocks go forward again in the spring) but there was nothing in the logs to indicate the time when Windows applied the changes.

After a bit of research I found that this information is written to the registry when the time zone is selected at setup time, or via the Control Panel date and time applet. On my Windows Server 2008 system, reg query hklm\system\currentcontrolset\control\timezoneinformation returned:

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\timezoneinformation
    Bias    REG_DWORD    0x0
    DaylightBias    REG_DWORD    0xffffffc4
    DaylightName    REG_SZ    @tzres.dll,-261
    DaylightStart    REG_BINARY    00000300050001000000000000000000
    DynamicDaylightTimeDisabled    REG_DWORD    0x0
    StandardBias    REG_DWORD    0x0
    StandardName    EG_SZ    @tzres.dll,-262
    StandardStart    EG_BINARY    00000A00050002000000000000000000
    TimeZoneKeyName    REG_SZ    GMT Standard Time
    ActiveTimeBias    REG_DWORD    0x0

It’s the daylightstart and standardstart values that are of interest here – reg query hklm\system\currentcontrolset\control\timezoneinformation /v daylightstart returns:

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\timezoneinformation
    daylightstart    REG_BINARY    00000300050001000000000000000000

and reg query hklm\system\currentcontrolset\control\timezoneinformation /v standardstart shows:

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\timezoneinformation
    standardstart    REG_BINARY    00000A00050002000000000000000000

Although I can’t work out the format of the binary data, I can see the differences. Ignoring the second 8 bytes (which is all zero) I can see that the differences are:

00 00 03 00 05 00 01 00

00 00 0A 00 05 00 02 00

That looks to me like 03 might be March and 0A (decimal 10) might be October, whilst and 01 may represent 1am in which case 02 would be 2am.

There’s also some more information in Microsoft knowledge base article 914387 including a link to the Windows Time Zone Editor (tzedit.exe) utility that is used to create timezones (as well as to another utility for combing event logs). The Windows Time Zone Editor is written for Windows 2000 and I’ve not been able to get the resulting time zone that I defined to load on my 64-bit copy of Windows Server 2008 in order to work out the resulting registry changes but I’m pretty sure that the 05 in the registry values for daylightstart and standardstart represents the last day (the options are 1st, 2nd, 3rd, 4th and last) and that one of the 00s is Sunday. One thing that it does do is to confirm that daylight saving for Greenwich Mean Time (British Summer Time) starts on the last Sunday of March at 01:00 and ends on the last Sunday in October at 02:00 – as shown in the accompanying image.

If anyone knows any more about the bytes I haven’t tracked down yet, I’d be pleased to hear your comments!