Disable DateTime

[01310564]

Help!!!

I'm tring to stop users from being able to change the Date and Time on there PC's. We use windows 2000 which isn't a problem because i can just delete the timedate.cpl but when I delete it on XP the system restores it.

I could change the security settings of this file by going around every computer but that could take a couple of days.

Stoping the users from changing the date and time through the control panel isn't a problem because there is a regestry setting that i can change, it's when they double click on the clock that the problem occurs.

Maybe something that could be done using a startup script?

Anyone got any ideas?

Cheers,

Hugh

 

[bcastner]

1.
(i). Use NTFS permissions on the timedate.cpl. You want to permit only the SYSYEM, local and domain administrators full access and deny all others access and other permissions.

(ii). I assume you have looked at the Group Policy setting in Administrative Templates for control over setting the time?

(iii). I assume when you mention the registry you are referring to these keys:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation

. Right click "TimeZoneInformation" and click Permission.
. Click the Advanced button.
. Click the Effective Permissions tab.
. Make sure the necessary permissions are all disabled for non-administrators.

That should more than do the job. With XP clients you have a second approach as well:

2. Use the Win2k reskit utility "ntrights.exe" to remove permissions.

"The system privilege, SeSystemTimePrivilege, controls the ability to set the system time. Time zone information, however, is considered part of the system time. In Control Panel, you cannot adjust the date or the time unless you have been granted the system privilege, SeSystemTimePrivilege. The default policy grants SeSystemTimePrivilege to "power users" and "administrators."

http://support.microsoft.com/defaul...port/kb/articles/q300/0/22.asp&NoWebContent=1

You can remotely change the privilege for your computers with the command:

ntrights -r SeSystemtimePrivilege -u Users -m \\computername

http://www.tburke.net/info/reskittools/topics/ntrights_examples.htm

 

[01310564]

Thanks for your help. The only thing that is of use to me is this Win2k reskit utility because i have 80+ pcs to do and i'm not going around each one.

The only problem is that I can't seem to find the Win2k reskit utility so do you know where i can download it from?


Cheers,

Hugh

 

[bcastner]

http://www.petri.co.il/download_free_reskit_tools.htm