Solved

Preventing Users from Changing System Time using GPO

Posted on 2011-09-17
7
408 Views
Last Modified: 2012-05-12
I have an office running a Windows Server 2008 x64. In this office all workstations are running Windows 7 Pro x64.

Each user has their own workstation. They run an application that requires the user to be a local admin of the machine.

There is also a Time clock software that runs on each computer that each user uses to clock in and out throughout the day. Poor design of the software has left an opening that the time people clock in or out is based on the WORKSTATION time not the server time.

I have Atomic.exe running across the network to keep accurate times, but 2 employees have figured out how to change the time on their macines to suit there purposes.

I would like to create a GPO to control users from being able to make changes to their system clocks but have been unable to find the right place to lock this down.

Can anyone please point me to the proper directory to set this. I'm sure it is simple, but I am just not finding it.

Thanks!
0
Comment
Question by:Luuker
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 40

Expert Comment

by:als315
ID: 36555614
If your user is local admin, he always will have enough rights.  I think you should invesigate your application, may be full rights for some folders or registry object will be enough.
0
 
LVL 40

Accepted Solution

by:
als315 earned 500 total points
ID: 36555955
This policy is here (Change the system time):
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
0
 
LVL 16

Expert Comment

by:cantoris
ID: 36556604
Use Process Monitor to find out what is wrong with your application - it may just be a simple case of altering permissions on a folder or a registry key.  You really need to ditch your user's admin rights!
0
 

Author Comment

by:Luuker
ID: 36557558
Thank you for your input. I will check tomorrow when I get in the office.

I agree I would love to ditch the local admin rights, but the EMR software runs SQL express plus a few other things that absolutely has to have admin rights to run. Usually I am able to simply remove access to things I need to adjust like desktop backgrounds, screen savers, power supply settings, and Proxy information. I set it all using GPO, then remove the menu from the PC so even if they do have rights, the option is gone.

The clock is a bit different though. I want it to stay there, but them just not be able to change it. I will set the GPO in the morning and see what happens.

Thanks for the info!  You guys rock!
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 37052272
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to extract and to view the contents of a Microsoft Update Standalone Package (MSU) for Windows Vista, you cannot extract the files from the MSU. Here we are going to explain how to extract those hotfix details without using any third pa…
While working, an annoying popup showing below will come and we cannot cancel or close it form the screen. The error message will come again and again.
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question