0

Back in Windows XP typical users couldn't change system's time zone. In newer versions the time zone can be changed even by non-admin users. I can understand the reason they added this ability, but it can really mess up with one of our time logging apps. So we decided to provide our users an option to disable this.

In "Local Security Policy" the key "Local Policies/User Rights Assignment/Change the time zone" contains the value "LOCAL SERVICE,Administrators,Users".

To make it short, we need a way our app (written in C#) to be able to remove or add the "Users" part from the above policy. Our app includes a system service so it has elevated rights.

We could use windows command prompt or free-to-distribute third party tools.

(PS: No server is involved, no DC, AD, etc. Just standalone PCs.)

Improve this question
4
  • If they are Administrator on the local machine they can reverse any changes you make.
    – Ramhound
    Commented Aug 30, 2015 at 22:09
  • @Ramhound It seems to me that the users don't have service-level access, only that part of the application does.
    – Ben N
    Commented Aug 30, 2015 at 22:11
  • @Ramhound admins should be able to change time-zone. We need to prevent non-admins from doing so.
    – monica
    Commented Aug 30, 2015 at 22:14
  • Depending on what language your app is written in, it might be easier/better to use the Windows API directly; see LsaAddAccountRights and LsaRemoveAccountRights
    – Ben N
    Commented Aug 30, 2015 at 22:36

2 Answers 2

Reset to default
0

This can be accomplished via the command line (and therefore an easy process launch from code) using NTRights, which is part of the Windows Server 2003 Resource Kit Tools bundle. ntrights.exe is invoked with -u followed by the group or user name and +r or -r to add or remove (respectively) the following privilege.

Therefore, ntrights -u Users +r SeTimeZonePrivilege grants the privilege to change the time zone and ntrights -u Users -r SeTimeZonePrivilege (note the -r) revokes it.

Further reading: More on privileges, a list of common privileges

Improve this answer
1
  • Thanks @Ben but as far as i understood the license of RKT, i can not redistribute ntrights.
    – monica
    Commented Aug 30, 2015 at 22:33
0

After a long search during the last 3 days i found a free-to-redistribute tool that can easily manage security policies. It's called "Grant". The creator's (Andreas Hansson) site and bussiness no longer exist, but i found a copy at wayback machine, including the file to download: https://web.archive.org/web/20150113021825/http://franzo.co.nz/hansson/grant.htm

Usage examples:

grant add SeSystemtimePrivilege Users

grant add SeServiceLogonRight myDomain\ServiceAccount

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .