No announcement yet.

Prevent users from changing Time

  • Filter
  • Time
  • Show
Clear All
new posts

  • Prevent users from changing Time

    I wanna to apply a policy in my domain in which responsible for the following:
    1- All PCs in my domain take its time from Domain controller time
    2- Prevent users from changing time in thier PCs.

    Any help will be appreciated.

  • #2
    Re: Prevent users from changing Time

    Not in front of a server at the moment, but check out "User Rights" in group policy
    It should be one tick box...
    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    IT Trainer / Consultant
    Ossian Ltd

    ** Remember to give credit where credit is due and leave reputation points where appropriate **


    • #3
      Re: Prevent users from changing Time

      These are computer configurations

      GPO configuration for clients to take its time from Domain controller:
      Computer configuration/Administrative Templates/System/Windows Time Service/Time Providers --->

      By default only members of one of the Windows XP local groups: 'Administrators' or 'Power Users' are allowed to change the sytem time. This is a local policy.
      You can take the control by this policy in the Computer configuration:
      Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment/ ---> Change the system Time


      This posting is provided "AS IS" with no warranties, and confers no rights.


      ** Remember to give credit where credit's due **
      and leave Reputation Points for meaningful posts


      • #4
        Re: Prevent users from changing Time

        Thank you very much.
        But the big problem that all of my clients are members of Power Users by default!!
        How can I change this configuration from Domain Controller?
        When I checked AD Users and Computers, all users are members of Domain Users, but when I checked each user on his machine, I found that each user is a member of Power Usrers.


        • #5
          Re: Prevent users from changing Time

          That probably means the domain users group is a member of the local power users group on the local machines.

          Often, you can use this to good effect by giving people power over their local computer by adding "Domain Users" (or some other AD security group) to the local Power Users group.

          You can control this through Group Policy, Computer Configuration -> Windows Settings -> Security Settings -> Restricted Groups. Have a look at

          Also, a batch file at startup can do things along this line, such as (Thanks to Sorin for this tip )
          net localgroup Administrators [domain\user] /add
          You might wish to put /delete instead of /add, but you'll need to decide what you want to achieve and use these to best effect.

          Also, using the batch file method to add groups to more powerful groups, can only be used when the user account who logs in is a member of the Administrators group anyway, so really to use the batch file method, you'd have to logon to the PC as an Admin to run the command, in order to get it to work. That's because if you run the command in the context of a domain user, it is trying to promote people into powerful groups, and domain users can't do that.
          Last edited by PaulH; 16th August 2007, 17:22.
          Best wishes,
          MCP:Server 2003; MCITP:Server 2008; MCTS: SBS2008