I have a Windows XP Pro desktop, I am trying to audit a system time change
failure attempt by a user. I have system event failures selected on my audit
policy and only have administrators allowed to change system time in user
rights assignments. When the user tries to change the system time from
anywhere, he is given a failure message but it will not log this event in the
security event viewer. I have even gone as far as going into regedt32 and
setting auditing on failure to access registry keys I believe have to do with
system time but still NOTHING LOGGED in security event viewer.
HKLM\microsoft\windows nt\current version\time zone
HKLM\system\current control set\control\timezone info
What am I missing? Thanks, Peter.

You might try auditing for privilege use for failure to see if that
lps. --- Steve


"hotairguy" <(E-Mail Removed)> wrote in message
news:3BACA87B-D71A-43B7-9F0F-(E-Mail Removed)...
>I have a Windows XP Pro desktop, I am trying to audit a system time change
> failure attempt by a user. I have system event failures selected on my
> audit
> policy and only have administrators allowed to change system time in user
> rights assignments. When the user tries to change the system time from
> anywhere, he is given a failure message but it will not log this event in
> the
> security event viewer. I have even gone as far as going into regedt32 and
> setting auditing on failure to access registry keys I believe have to do
> with
> system time but still NOTHING LOGGED in security event viewer.
> HKLM\microsoft\windows nt\current version\time zone
> HKLM\system\current control set\control\timezone info
> What am I missing? Thanks, Peter.