Solved

Preventing Users from Changing System Time using GPO

Posted on 2011-09-17
7
401 Views
Last Modified: 2012-05-12
I have an office running a Windows Server 2008 x64. In this office all workstations are running Windows 7 Pro x64.

Each user has their own workstation. They run an application that requires the user to be a local admin of the machine.

There is also a Time clock software that runs on each computer that each user uses to clock in and out throughout the day. Poor design of the software has left an opening that the time people clock in or out is based on the WORKSTATION time not the server time.

I have Atomic.exe running across the network to keep accurate times, but 2 employees have figured out how to change the time on their macines to suit there purposes.

I would like to create a GPO to control users from being able to make changes to their system clocks but have been unable to find the right place to lock this down.

Can anyone please point me to the proper directory to set this. I'm sure it is simple, but I am just not finding it.

Thanks!
0
Comment
Question by:Luuker
7 Comments
 
LVL 39

Expert Comment

by:als315
ID: 36555614
If your user is local admin, he always will have enough rights.  I think you should invesigate your application, may be full rights for some folders or registry object will be enough.
0
 
LVL 39

Accepted Solution

by:
als315 earned 500 total points
ID: 36555955
This policy is here (Change the system time):
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
0
 
LVL 16

Expert Comment

by:cantoris
ID: 36556604
Use Process Monitor to find out what is wrong with your application - it may just be a simple case of altering permissions on a folder or a registry key.  You really need to ditch your user's admin rights!
0
 

Author Comment

by:Luuker
ID: 36557558
Thank you for your input. I will check tomorrow when I get in the office.

I agree I would love to ditch the local admin rights, but the EMR software runs SQL express plus a few other things that absolutely has to have admin rights to run. Usually I am able to simply remove access to things I need to adjust like desktop backgrounds, screen savers, power supply settings, and Proxy information. I set it all using GPO, then remove the menu from the PC so even if they do have rights, the option is gone.

The clock is a bit different though. I want it to stay there, but them just not be able to change it. I will set the GPO in the morning and see what happens.

Thanks for the info!  You guys rock!
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 37052272
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Courses: Start Training Online With Pros, Today

Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup" or a blinking cursor with black screen. A loop for Auto repair will start but fix nothing.  You will be panic as there are no back…
On some Windows 7 (SP1) computers, Windows Update becomes super slow even the computer is reasonably fast.  There's one solution that seemed to have worked well for me (after trying a few other suggested solutions).
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question