Prevent change of system time on a network

I have a network that we are adding a program so they can clock-in from their workstations. I use roaming profiles.

Each workstation gets the system time from the server, but they can change the time at their workstation.

I want to prevent this from tempting them to change the time if they are late.

Is there a way to prevent the ability of changing time on their workstations. But allow the administrator rights to do so if necessary.

Who is Participating?
epochassetConnect With a Mentor Commented:
You can do this in Group Policy, however due to possible variations in time between machines it would be best to use a solution that will only record times at the server, meaning that the workstation's time is never used and is irrelevant.  They clock in and out from the workstation, but the server's time is used for both values.  If they dont have access to the server you will get the most accurate representation of the time spent even if you ever run into a problem with external time synch.

The group policy setting your looking for is in, Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment.  Youll find 'Change the system time' as well as 'Change the time zone'.
You can do that by removin gthe SeSystemTimePrivilege privilege from their accounts. This privilege is usually granted to Administrators and Power Users. See ("How to Set Logon User Rights with the Ntrights.exe Utility") for how to do that on the command prompt and ("You cannot set the date, time, or time zone on your computer") for a description about what that privilege does. BTW, this can also be administered using the "Local Security Policy" control panel applet.
You can use the NTRight utility to prevent users from changing their system time clock. 
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Oh, since this is the NT4 area, you'll find th eprivilege management in the "User Manager" control panel applet, IIRC.
proffittwareAuthor Commented:
I will check these out and get back to all of you !!!

For what it's worth... I had the same problem one time.  It was with a primitive MS-Access based timeclock system.  My solution was to set the app up so it does a time-sync with the server each time the person clocks in/out.  Specifically, I had a single line of vba code that called a "shell" command on a "net time" command.  The whole thing just flashed a command-prompt box in the taskbar and nobody noticed.  It actually resolved some minor time adjustment issues as a nice side-effect and most people thanked me for it.

This worked adequately for a couple years, but my good friend "Windows Vista" decided I should be denied access to these commands, so I rewrote the app to run in PHP.  
All Courses

From novice to tech pro — start learning today.