Okay, tell me if I'm crazy

[hipsterdoofus]

Backup info:
We have an inhouse program that in order to work correctly, has to keep a system's time in sync. What we used to do with XP (and yes, yes, I know there are potential security issues here) is go into local security policy and allow Users or Domain users to change the time, thereby allowing the program run by them to change the time.

Fast forward to Windows 7. I was testing the same program and kept getting permissions issues (logged in as administrator). I had allowed regular users to change the time in the same way. Anyway, so after banging my head against the wall for this problem for a day or two, come to find out, it appears to work correctly for regular users, just not for domain admins who are running it non-elevated.

So here is my crazy question. I know the policy shouldn't pertain to administrators (and shouldn't need to), but I also know with Windows 7, (forgive me if I don't know the correct wording here) - as administrator logging in you have two tokens, one as a regular type user, one as administrator.

Is it possible that the policy changes didn't affect my "regular user" token, and that is why I get permission issues as administrator but not as a regular user? Sounds crazy but it is the only thing I can think of...

 

[Daave]

Well that sounds a little unexpected question, it seems you are too much into knowing things which are so uncommon. Sorry but i have no idea of it but still reading it wanted to reply on it.

 

[hipsterdoofus]

Well, yes I MAY be crazy....but I was wondering if my THEORY was crazy...

 

[Maguscreed]

Yeah, I'm personally not a huge fan of editing security policy.
It seems to me however you could just run the app individually from all the machines with a startup routine.

 

[hipsterdoofus]

Yeah, I'm personally not a huge fan of editing security policy.
It seems to me however you could just run the app individually from all the machines with a startup routine.

This particular app only runs as needed, so we don't want it to run on startup.

Now we DO have another one that could be run that way on our public computers (I am in a library environment) because it runs at startup and runs all the time.

 

[Maguscreed]

Running on local machine may be more complicated but I think it will solve the problem without you having to edit permissions outside of comfort zone.

 

[hipsterdoofus]

Okay - well that may be the case - but again, is my theory correct as to why I was getting permissions errors? Just kind of an odd thing and wanted to know if I was correct in my assessment.

 

[Maguscreed]

Policies are group based so yes, it's completely possible that is the case.