the windows time service can find a time server that has the incorrect time set and set your time to that time and then shutdown
I would think that you could go and configure the time service to be disabled so that it never tries to sync the time from some other machine.
you can start cmd.exe as an admin
and use w32tm.exe /? for help
w32tm.exe /tz (will display the current time zone settings)
there is a debug function to make the service log what it actually does. I would think this could help you to figure where it is getting the time setting.
(I don't know where it gets it, router, cable modem, cable provider? other computers on the same network?)
just googled it: looks like it uses a Network Time Protocol by listening to a particular port
http://en.wikipedia.org/wiki/Network_Time_Protocol
I looked in the registry to see where my system is getting its time setting. I am at home with no domain controller or other powered on machines.
regedit32.exe
\hkey_local_machine\system\currentcontrolset\services\w32time\parameters
there is a entry for NtpServer and my system is set to
time.windows.com
I guess it is where I get my time set from.
I did a trace route on the time server
tracert.exe time.windows.com
I am not getting a response. I guess this might be a common problem, lots of people change the time server to another provider.
I looked up how to change my time source:
here is info and links:
http://support.microsoft.com/kb/262680
here is info on some server pools you can use:
https://support.ntp.org/bin/view/Servers/NTPPoolServers
http://www.pool.ntp.org/en/use.html
the last link shows the command you would enter on windows to change the time source from the default.
w32tm.exe /config /syncfromflags:manual /manualpeerlist:0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org
(guess the default location is often under attack)