A rollback of a clock on a computing device is detected and responded to. A current time from the clock and a stored time from a secure store are obtained and compared to determine whether the obtained current time is earlier than the obtained stored time. If so, a predetermined course of action is taken based on the determination.