Solved

Preventing Users from Changing System Time using GPO

Posted on 2011-09-17
7
404 Views
Last Modified: 2012-05-12
I have an office running a Windows Server 2008 x64. In this office all workstations are running Windows 7 Pro x64.

Each user has their own workstation. They run an application that requires the user to be a local admin of the machine.

There is also a Time clock software that runs on each computer that each user uses to clock in and out throughout the day. Poor design of the software has left an opening that the time people clock in or out is based on the WORKSTATION time not the server time.

I have Atomic.exe running across the network to keep accurate times, but 2 employees have figured out how to change the time on their macines to suit there purposes.

I would like to create a GPO to control users from being able to make changes to their system clocks but have been unable to find the right place to lock this down.

Can anyone please point me to the proper directory to set this. I'm sure it is simple, but I am just not finding it.

Thanks!
0
Comment
Question by:Luuker
7 Comments
 
LVL 40

Expert Comment

by:als315
ID: 36555614
If your user is local admin, he always will have enough rights.  I think you should invesigate your application, may be full rights for some folders or registry object will be enough.
0
 
LVL 40

Accepted Solution

by:
als315 earned 500 total points
ID: 36555955
This policy is here (Change the system time):
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
0
 
LVL 16

Expert Comment

by:cantoris
ID: 36556604
Use Process Monitor to find out what is wrong with your application - it may just be a simple case of altering permissions on a folder or a registry key.  You really need to ditch your user's admin rights!
0
 

Author Comment

by:Luuker
ID: 36557558
Thank you for your input. I will check tomorrow when I get in the office.

I agree I would love to ditch the local admin rights, but the EMR software runs SQL express plus a few other things that absolutely has to have admin rights to run. Usually I am able to simply remove access to things I need to adjust like desktop backgrounds, screen savers, power supply settings, and Proxy information. I set it all using GPO, then remove the menu from the PC so even if they do have rights, the option is gone.

The clock is a bit different though. I want it to stay there, but them just not be able to change it. I will set the GPO in the morning and see what happens.

Thanks for the info!  You guys rock!
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 37052272
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question