<b>Windows 2k Pro Security (GPO)</b>

[masil]

I want to allow a few users to be able to change their
system time in windows without giving them the privilage
to install any program on the machine. Some users need to
change the time for programming and testing softwares.

I went to edit the GPO with gpedit.msc (on a Win 2k Pro client Station) and changed the
properties by adding the uesr to be allowed to change the
time:

Computer configuration->windows settings->Security
Settings->Local Policies->User Rights Assignment->Change
system time

But I can only edit the local settings (check-box) but not
the effective settins right next to the local one (also a
check-box). So the property is still not assinged to the
user. I also tried to restart the computer but doesn't
change a thing.

So I went into the GPO editing on the SBS 2000 station (Active Directory Users and Computers -> Right click on domain name for properties -> Edit the GPO values "Change system time" to the assigned user). But when i get back to the client machine, nothing's changed; i even did a refresh with the following command: secedit /refreshpolicy MACHINE_POLICY

Also, when i get back to the client machine and try to add a user, FROM THE DOMAIN, for the "Change System Time" policy, i get the message it cannot connect to the domain. I don't get it because i know i am connected to the domain and that i'm not on a workgroup (ping works, shares work, internet works...).

 

[Rhodizzle]

1. Make sure that the GPO is linked to a folder where all of the applicable resources are underneath it, IE if you have users in multiple OUs that you are applying this policy to, the link has to be to a parent OU to all of them. B when you use that command on the machine it attempts to make the local machine policy the effective setting, but if it isn't configured correctly on the server, the domain policy overwrites local policies. Try running gpupdate from the DC also to initiate a push of the gpo changes to the clients. I'm kinda new at running AD DCs/GPOs, so if any of this isn't correct or is unclear, please correct/ask for clarification.