2

I need to allow a couple specific users rights to change their local system time in Windows 7 x64. I have already assigned them the right through group policy using the "Change the system time" user right assignment but UAC is preventing them from actually changing the time. We have a similar setup for changing IP settings which allows users to authenticate UAC with their own credentials but this isn't working for time settings. Any help would be appreciated. Thanks

SonoIT
  • 71
  • 1
  • 5

2 Answers2

4

You don't want users changing the time on domain-joined computers. This will break Kerberos and will cause users to suffer authentication failures or, worse, not be able to logon to the PCs.

What are you trying to accomplish by having the users change the system time?

Evan Anderson
  • 141,881
  • 20
  • 196
  • 331
  • I am in a similar situation. One scenario where the capability to change time is critical is running tests on embedded systems synced to the system clock and evaluation of time triggered events. For. e.g. one of our test involves running the device overnight and advancing time by a day/week,month every minute or so, simulating years of usage in a short time. – Vaibhav Garg Jan 13 '12 at 10:57
  • 1
    @VaibhavGarg: I tend to think, in that situation, your testers would be better off using a non-domain-joined testing computer or, failing that, a virtual machine running the test interface. There's a separation-of-duties issue here. The tester needs a machine they can arbitrarily control the time on, but a domain-joined PC needs its time managed by a network time service. It might be frustrating to have to spend money on giving them a solution that involves another computer (or the labor to configure a VM) but they really need two different and distinct things. – Evan Anderson Jan 13 '12 at 13:39
0

Maybe there is a way via a powershell script? Now that you have allowed the policy, running from a command line might bypass the UAC?

PS C:\>Set-Date -Date (Get-Date).AddDays(2)
PS C:\>set-date -adjust -0:30:0
PS C:\>$halfhr = new-timespan -minutes 30
PS C:\>set-date -adjust $halfhr
djangofan
  • 4,182
  • 10
  • 46
  • 59
  • I tested using the set-date commandlet as a limited user and it did work. This is ok as a temp work around since the users are programmers but not ideal. – SonoIT Jan 12 '12 at 20:37
  • 2
    If your users are programmers and they find working at the command line "not ideal" then something is terribly wrong. – Skyhawk Jan 12 '12 at 20:56