Lock the clock?

[hande]

How do you lock the clock to stop users changing the time? other than not making them part of the Administators or powers users group?

We are running Navision and the software only works if the user is part of the administrator group but I want to lock the clock as someone changed the system time amonth ago and its taken a whole month to fix the data that was incorrectly posted at hq

Many thanks

Hande

 

[gavm99]

There may be a group policy setting for this........

What I do though is use a bat file every time my users log in to synchronize the local time with my server which is running chronograph to keep itself correct.

 

[hande]

Thanks for that!! but how do I do it? as in how do i lock the clock?

 

[gavm99]

I don't know if there is a group policy setting for this - I was suggesting there maybe. It is not something I have done.

If you want to syncronize their local time use this is a bat file as part of your logon script:

net time \\SERVERNAME /set /yes

I will also have a dig for today and see if I can find a group policy setting for the clock.

 

[gavm99]

I don't if this is any good to you but I can hide the clock using the registry.

You could sync the time when the logon and then hide the clock.

Would that be of use?

 

[hande]

Many thanks Gavm99!!

Hande

 

[hande]

Not really I need the clock there I just need it locked down so poeple can see it but not change it

Regards
Hande

 

[TheLad]

Can't you just remove timedate.cpl from C:\Windows\System32 as this will effectively disable the changing of the time?

Note: you will also have to remive the timedate.cpl file from C:\Windows\System32\Dllcache otherwise you will get Security errors about missing/corrupt Windows files, and also if the file still exists in the DLLCache folder, Windows will automatically put it back into C:\Windows\System32

-----------------------------------------------------
"It's true, its damn true!"
-----------------------------------------------------

 

[bcastner]

Setting the system time is a right controlled by:
SeSystemtimePrivilege

Reference:

http://support.microsoft.com/defaul...port/kb/articles/q300/0/22.asp&NoWebContent=1

You use NTRIGHTS.EXE, found in the Windows 2003 resource kit, or directly:

http://www.dynawell.com/reskit/microsoft/win2000/ntrights.zip

Place a copy in %windir%\system32. The utility allows setting rights on remote machines. See:

http://support.microsoft.com/kb/q266280/

The exact command required:
ntrights -r SeSystemtimePrivilege -u "Administrators"

 

[WomPom]

Microsoft has an Shared Computer Toolkit application for shared computers that I use to keep our evening ESL students from tampering with our office computers.

Checkout <

http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

>

As MS says: ' The Shared Computer Toolkit is ideal for computers in schools, public libraries, community technology centers, and Internet cafés. It allows those who manage shared computers in these environments to easily:
• Defend shared computers from unauthorized changes to their hard disks.
• Restrict users from accessing system settings and data.
• Enhance the user experience on shared computers. '

Occasionally MS does something right ... now if they would make IE uninstallable.

Buon Me Thuot
DakLak Province
Central Highlands, VietNam
///

 

[bcastner]

WomPom,

I too am a fan of the Shared Computer Toolkit.

It is interesting to note that Windows Vista has very explicit controls on clock settings.

There are several strong suggestions as to how to implement this for Windows XP in this thread, and your contribution is a welcome addition.

And, Welcome to Tek-Tips!

Bill Castner