Question : Group policy question regarding date and time

Hi,

I have a simple Active Directory Forrest with several client workstations bound in. Most of the default Group Policy settings are fine, however I have a piece of (badly written!!) software which occasionally requires the user to change the Date settings of their local machine for a period of time.

Can this be done so Users are not prompted for an admin password when attempting to change date and time settings.

Server software is Windows 2008 standard and clients are windows 7 Pro.

Many thanks in advance.

Answer : Group policy question regarding date and time

Hi there,

Changing the system time on any domain machine will cause you problems if it is over 5 minutes out from the DC. Kerberos requires time sync to protect against replay attacks and the like.

If you change the system time on your machine you're likely to get authentication errors. However w32time will also notice the time is skewed and correct this so you may have to keep 'correcting'.

Anyhow, to change the system time, you can grant the users the right:

Computer Configuration > Windows Settings > Security Settings > Local Policies ? User Rights Assignments > Change the system time.

If you add your users/group here, either on local policy or apply via a GPO, they should be able to change the time.

Tony