Home / server / Questions / 244972
In Process
user72128
Asked: 2011-03-09 16:14:33 +0800 CST

Restrict Administrators from changing system time - Windows XP machines (no domain)

  • 772

I need to write a script that will remove all users under Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > User Rights Assignment > Change the system time from the local group policy (gpedit.msc) on all Windows XP machines. These machines are not on the domain. I DO have a way to distribute and run the script automatically. Can someone point me in the right direction for creating a script like this?

scripting group-policy windows-xp

2 Answers

  1. Well, ignoring the fact that an administrator can just change it back.. ;)

    The secedit tool should provide the functionality you need. Use /areas SECURITYPOLICY.

    • 2

  2. Late answer but may be useful. You also can try to do it using utility from Windows Server 2003 Resource Kit Tools ntrights.exe.

    Example script (tested on Windows XP Professional SP3):

    @echo off

echo Start process %date% %time% >> %~dp0%~n0.log

cd /d "c:\work"

rem Revokes "Change system time" right from Administrators
ntrights.exe -r SeSystemtimePrivilege -u "Administrators" >> %~dp0%~n0.log
rem Revokes "Change system time" right from Power users
ntrights.exe -r SeSystemtimePrivilege -u "Power Users" >> %~dp0%~n0.log
rem Revokes "Change system time" right from user2
ntrights.exe -r SeSystemtimePrivilege -u "user2" >> %~dp0%~n0.log
rem Grant "Change system time" right to user1
ntrights.exe +r SeSystemtimePrivilege -u "user1" >> %~dp0%~n0.log

echo End process %date% %time% >> %~dp0%~n0.log

rem Reboot if you need
shutdown /r /t 10
    • 1