Prevent user changing time manually?

[gkarasik]

Hi,

I have a user who keeps changing the time on her Win7 workstation. The PC eventually resets the correct time automatically, but I would like to find a way to prevent her changing time manually. I've looked at various ways to prevent users from changing time (local security policy, GPO), but they all prevent not only the manual time-change but also the automatic reset of the time. What I seek is a way to prevent the manual time-change that still allows the automatic. I'm open to a third-party solution as well.

GaryK

 

[GokAy]

Change the user instead!

Sorry couldn't resist

Hope you solve this.

 

[gkarasik]

Change the user instead!

Sorry couldn't resist

Hope you solve this.

If wishes were horses then beggars would ride.

Thanks for the sympathy.

 

[GokAy]

Hey after dinner, I searched for this and found http://www.sevenforums.com/tutorials/113557-date-time-allow-prevent-users-groups-changing.html

See if it helps you. (No dry sympathies)

Note: Reading a bit on that page, I don't see any regular user account or groups. Perhaps your user is a local admin on that machine?

 

[RolandJS]

What was the reply when you asked the user why is the time constantly being changed? Maybe the problem and solution is further upstream.

 

[gkarasik]

Hey after dinner, I searched for this and found http://www.sevenforums.com/tutorials/113557-date-time-allow-prevent-users-groups-changing.html

See if it helps you. (No dry sympathies)

Thanks. These alternatives prevent both manual and automatic reset. I want to prevent manual changes, but I want the system time to be correct and to autocorrect as necessary.

GaryK

 

[gkarasik]

What was the reply when you asked the user why is the time constantly being changed? Maybe the problem and solution is further upstream.

Known her for a long time. She's poorly organized. She likes to keep the clock five minutes fast. If I can find a local solution, that would be better than taking it to management. That option is open, but for later if I can't find a local solution.

GaryK

 

[GokAy]

According to post #3 by Brink (he is the Admin with over 50k posts, I guess he knows what he is talking about) in the link I gave:
"Only listed users and groups are allowed to change the date and time. You'll just need to add any user or group that you want to allow to change the date and time."

So if that user is able to change date time, then there is a problem somewhere in your domain(?)/local computer. As an example, I have seen users being added to local administrators group so they could install programs before. So it may be possible in your case.

See there are 2 preconfigured allows in the Local Security Policy. Administrators (manual) and Local Service (I believe this is the automatic). Not an expert in this issue but that's what I understand. Your user shouldn't be able to change in the first place!

Wanted to add: I haven't worked in a corporate environment for a long time, you might need to check group policy instead.

 

[gkarasik]

According to post #3 by Brink (he is the Admin with over 50k posts, I guess he knows what he is talking about) in the link I gave:
"Only listed users and groups are allowed to change the date and time. You'll just need to add any user or group that you want to allow to change the date and time."

So if that user is able to change date time, then there is a problem somewhere in your domain(?)/local computer. As an example, I have seen users being added to local administrators group so they could install programs before. So it may be possible in your case.

See there are 2 preconfigured allows in the Local Security Policy. Administrators (manual) and Local Service (I believe this is the automatic). Not an expert in this issue but that's what I understand. Your user shouldn't be able to change in the first place!

Wanted to add: I haven't worked in a corporate environment for a long time, you might need to check group policy instead.

You are correct in every respect. The user can change the time. I can prevent this, but this also prevents the automatic reset. A solution may not be available, but I seek a more-granular solution that allows the system to change the time but not the user. Group Policy has the same effect--time change either on or off.

Perhaps there's a per-user way to remove the "Change date and time settings..." option from the tray-clock dialog. That might mean editing a DLL. That in turn presumes locating the correct DLL.

 

[GokAy]

Are you absolutely sure this user of yours has a regular user account? Perhaps a power user but then again only admins have the right to change time, so I don't know :sarc:.

Are you in a domain environment? You never told anything about it. Provide with some details please, not for me, but for those more knowledgeable in managing a domain. (If you are in a domain)

I still think you are looking at the wrong direction trying to prevent something that's supposedly not happening in the first place.

----------------
Another idea would be finding a clock program that would run independent of the system date/time which she could adjust to her heart's desire. I did search a bit but all seems to sync with system. Maybe you will find such a program easier, as English is 2nd language to me.

I bet this would be extremely easy for someone with programming knowledge, perhaps you can find someone here in this forum.

Thanks for bearing with me

 

[RolandJS]

If her computer is five minutes ahead of everyone else in that office, does that affect any server-level folder & files backup? Sharing of her documents, modified or not, with others? If so, you're going to have to gently explain the unintended consequences of the five-minute difference upon others, and, appeal to her sense of accomplishment that leaving the correct time is best for everyone, including her.

 

[gkarasik]

Are you absolutely sure this user of yours has a regular user account? Perhaps a power user but then again only admins have the right to change time, so I don't know :sarc:.

Are you in a domain environment? You never told anything about it. Provide with some details please, not for me, but for those more knowledgeable in managing a domain. (If you are in a domain)

I still think you are looking at the wrong direction trying to prevent something that's supposedly not happening in the first place.

----------------
Another idea would be finding a clock program that would run independent of the system date/time which she could adjust to her heart's desire. I did search a bit but all seems to sync with system. Maybe you will find such a program easier, as English is 2nd language to me.

I bet this would be extremely easy for someone with programming knowledge, perhaps you can find someone here in this forum.

Thanks for bearing with me

Sorry, I should have said. Win7 Ent/SP1. She's an admin, for corporate/political reasons, and that's the way that's going to stay. I can argue for the time-change restriction because it's a security issue, but the larger, Admin status is not going to change. Yes, it's a domain. I like the 3rd-party idea and am looking; perhaps an alarm program. I'm also going to look at the option of adding full System permissions to the LocSec policy.

No bearing with you going on. This is helping me think this through. I appreciate your devoting time to my problem.

 

[gkarasik]

If her computer is five minutes ahead of everyone else in that office, does that affect any server-level folder & files backup? Sharing of her documents, modified or not, with others? If so, you're going to have to gently explain the unintended consequences of the five-minute difference upon others, and, appeal to her sense of accomplishment that leaving the correct time is best for everyone, including her.

Thanks. Already gently explained. Response was "Uh huh."

GaryK

 

[RolandJS]

We posted at the same time, did you see my questions & possible suggestion?

 

[gkarasik]

We posted at the same time, did you see my questions & possible suggestion?

Yes, and responded. Thanks.

 

[GokAy]

Oh here we go, so she is an admin

Go to the link I gave earlier, and do try the option to "To Only Prevent Specific Administrators ".
Basically, you will remove the Administrators group and add all administrator accounts but her manually one by one!

Hopefully someone with domain experience will comment if the procedure is different in such a setting. For example, does the Local Security Policy get overridden by group policy or some other policy?

 

[DavidE]

Do you know what account is used to change the time automatically ???
Maybe you need to add the SYSTEM account to allow time changes, when you add GPO restrictions ???
I don't know, just guessing here.

 

[Callender]

Well here's some thoughts.... I use third party software to adjust my system clock. You can find the download here:

TimeSync

The intersting thing is that you can run it with the /AUTO switch and set it to only adjust time if clock deviation is greater than a specified number of seconds. It also works it's way through a list of time servers until one connects when using the /AUTO switch.

​

Maybe it's possible to install this portable application in a hidden folder and run it silently and automatically at regular intervals? Probably it could be done using task scheduler.

Just a thought.

 

[RolandJS]

I don't believe it will run invisibly; sooner or later, computer user will catch on.

 

[Callender]

Well I can get it to run on a schedule and sync the clock every minute without the program launch window showing up. The problem I've got is that once time sync is complete I get this window.



So if I could figure out how to hide it?

In any case even if the system clock was adjusted to always show the correct time using any method - obviously the user will catch on! I mean who doesn't check the time on their mobile phone, wristwatch of office wall clock?