User should not change System Date, but can view


I have a network setup wherein I want the set up such that, users can open and see the system date and time, but they are not authorized to change it. Even it is changed in the host machine, it should change back the sysdate and time to server date and time.
I am using Windows NT and Windows 2000 servers.
More Clear Description:
I have a Windows NT server, for which I have 50 users connecting. I want the user local machine which is again a NT machine, getting connected to my server. USer in the local machine when double clicks on time in the system tray, it displays the date and time window. But User should not be able to change the date and time. Even he tries to change, it should reflet the date and time in the server.
I want to do this, because the user will view the sysdate for many reasons like when doing any testing or want to plan his/her work. But he/she changes the date, the log files timestamp will change which I don't want to happen.

Thanks in advance for your help.

Kiran Kumar
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Put the domain user in Administrative group of LOCAL machine.
KIRANKUMAR012... Put the following in the users logonscript:

net time \\WindowsNTserverName /set /y

GANESHA... It's not that, KIRANKUMAR012 want: "But User should NOT be able to change the date and time"

:o) GANESHA..., and everybody else.

You must NEVER NEVER add a Domain User Group to the Local Admin Group on each workstation.

And You must NEVER add the same Domain User to the Local Admin Group on more than his/hers own workstation

If You add a Domain User Group to the Local Admin Group, every member of this Domain User Group gets unlimited REMOTE access power of every workstation on Your network.

The unlimited REMOTE access involves:
1. Explorer: \\ComputerName\C$
2. Registry
3. Computer Management (Control Panel)


You have to grant a Domain User Group to the Local Admin Group on BOTH test-workstations, AND logout and logon again.

Important: You have to make a new logon after creating the credentials, because they are given in W2k in the second where You press ENTER to password when logging on.

Please reply, when You have removed the Domain User Group from the Local Admin Group again!

Many Regards

Jorgen Malmgren

:o) Your brain is like a parachute. It works best when it's open

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
Post your closing recommendations!  No comment means you don't care.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.