Windows Forum

Ask something
Discussion Locked

How to take away everyone's Time Control

0 helpful
9 replies

by symesd

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I know how to edit the registry to remove user's ability to change the System Time on their PC's...but to do this for all users at certain levels...is policy editor the best way? How can I protect myself from messing this up for all users? Any Microsoft Documentation on this? How is it done with Policy Editor for NT4.0? (Never needed to do it till now).

9 replies

by tamj123

this is the way how do disable on W2K:
administrative tools\local security plicy\local polices\user right assignment, double click on "change the system time" remove check mark under everyone user.

by symesd

I should have clarified that I want all users at all NT4.0 and W2K workstations to not be able to change the time unless they are a Domain Admin or the Administrator.

by mrvalko

By default, only members of local groups Power Users and Administrators can change system time of a NT 4.0 WS, W2k prof. Administrators includes Domain Admins global group. Make naughty users only Domain users. Check in User Manbager for domains/User rights who has the right 'Change the system time' and make desired corrections. This is possible only if you have domain. Otherwise set up each computer manually.

by symesd

thanks...this helps for the system time issue but we also want to remove ability to change their screen saver...how do we do that?

by rorycarlin

Use the ntrights.exe tool from the NT4 Resource Kit. For example if you want to remove the 'Everyone' group from the 'Change System Time' ACL on each of your workstations:

Get a text file listing the name of each workstation on your domain called 'workstations.txt'. You can do this by typing 'net view > c:\workstations.txt' at a command prompt.

Then type the following:

for /f %i in (c:\workstations.txt) do c:\ntreskit\ntrights.exe /m %i /u Everyone -r SeSystemTimePrivilege

Each ofyour workstations will need to be active on the network at runtime for this to be completely successful. You can rerun the same command over again to cover any missed workstations.

Hope this helps.

by symesd

This would be great if I could find an NT Server Resource CD....only have 2000 Resource and NT WS Resource CD's....hence no NTRIGHTS.EXE utility....is it on the web?

by asarks

The safest way to do it use NT resource kit SeSystemTimePrivilege command.

This discussion is closed to new replies.