users often open their windows date/time widget to check a date, they will move the date ahead or back then don’t cancel the change. They do some work with the changed date then the computer does a time sync with a server on your domain and resets it back to the correct date/time.