NET TIME Scripting and privileges 1

[Guest_imported]

I am trying to organize my network at work a bit and I am writing a logon script for the users. The script itself is fine, but the workstations dont have access to change time. When I started working on this network, every user was in group Domain Users and Domain Admins. I took them out of Domain Admins but I gave the Domain Users group the SeSystemtimePrivilege rights. I figured this would allow them to change the time but it DOESN'T. Do I need to do anything else? I dont want them all to have Domain Admin Rights and I dont want to use a Timeservice.
Please help..
thx

 

[ChadStiller]

It's a matter of the user permssions on the workstation, not the server. By default all domain users are added to the local users on group on an NT/W2K workstation, and the domain admin group is added to the local administrators group.

Users will either need to be assigned the permsission on the local machine to change time, or added to the Power Users group of the local machine. Depends on the level of access/security you want to maintain, along with the number of machines you have to deal with.

Off the top of my head I can't recall if the workstation time setting can be set via group policy.... if that is the route you want to take I'd suggest some further research in the matter to isolate exactly what needs to be changed and how it can be inacted.

Chad Stiller, MCSE
Ramcom Technology
cds@ramcom.com

 

[ChrisBurch]

Try this in your user login script,

Net Time \\ServerName /Set /Yes

When they log on they get the time from whatever Server that you specify, and you maintain the time on the server.

 

[Guest_imported]

Ok, Thanks chad, I understand now... I was just hoping there was a faster way to do it from just the serverside. I will figure something out. I just dont want to give them too much privilege because they tend to really mess up the computers.

 

[ntroger]

Hi, there is a faster way to do this. If you have the resource kit, you should be able to add this privilege to all of your workstations using the ntrights command.

Logged in as a domain admin at a single location, you would run the following command for every workstation you want to change:

ntrights +r SeSystemTimePrivilege -u "domain users" -m \\computername

The syntax for this command is in technet article Q266280. There is an example of a script which sets this for every member server in a domain in Q173529. It should be easy to change this so it modifies your workstations. Hope this helps.

 

[Guest_imported]

unfortunately I dont have the resource kit, I am missing out on a lot of nice tools.. I got it taken care of though. Thanks for everyones help