How do I change time from limited account?

[Guest]

I have a home computer that has a clock on LED panel of the computer case.
But the front panel clock doesn't update when logged in as a limited user.
Even though the system clock in the tray is updating as normal.

It does however, update correctly if logged in as an administrators account.
It also updates correctly if I "switch users" to a limited account while the
administrators account is running in the background.

The manufacturer is trying to resolve the problem but has no answer yet.

I'm leaning toward the access privelages for changing the system time as a
possible cause of the problem.

For security reasons, I don't want inexperienced users having administrator
rights. But I need a way to allow them access to change the system time.

Short of adding some administrative tool to create a policy, are there any
simple fixes. Such as rights on a file somewhere, or registry keys that can
be edited?

 

[Jim Nugent]

I have a home computer that has a clock on LED panel of the computer case.
But the front panel clock doesn't update when logged in as a limited user.
Even though the system clock in the tray is updating as normal.

It does however, update correctly if logged in as an administrators account.
It also updates correctly if I "switch users" to a limited account while the
administrators account is running in the background.

The manufacturer is trying to resolve the problem but has no answer yet.

I'm leaning toward the access privelages for changing the system time as a
possible cause of the problem.

The right to change the time means change it to a different time e.g., ahead
or back 15 minutes. And that change would be reflected in the clock in the
tray. The clock will update under any any (or no) account. The fact that the
clock in the tray updates correctly shows that it's OK.

My guess is that some background process has to run to update the LED from
the system clock, and that process only runs only under the admin account.

First you should find out what that process is and make sure it is
configured to run for all users. It might be in the user startup folder or
registry key for admin only.

OTOH it may try to access a driver for that LED clock that needs some user
right, but I doubt it's the right to set the system time.

You could set it up to audit failed privilege use, and then examine the
event log.

Is your system XP Pro or Home. If it's home, I'm not sure how sophisticated
the user rights settings are anyway.

What does the LED clock do when no one is logged in?

 

[Guest]

I'm sorry, I should have mentioned that it is the MEC2005. And that at the
welcome screen, the clock doesn't update either. At startup, the front panel
has a welcome message. This message remains if I log into any of the various
limited accounts. But switches to the clock when entering admin account.

I'd like to know where to begin the process for auditing the failed event
log. That sounds like a promising common sense approach.

 

[Jim Nugent]

I'm sorry, I should have mentioned that it is the MEC2005. And that at the
welcome screen, the clock doesn't update either. At startup, the front panel
has a welcome message. This message remains if I log into any of the various
limited accounts. But switches to the clock when entering admin account.

I'd like to know where to begin the process for auditing the failed event
log. That sounds like a promising common sense approach.

I've never played much with XP Home, but here's how I'd do it in Pro. If
this doesn't work, a Home Edition user will have to chime in.

Click Start, then Control Panel. Switch to Classic View. Open Administrative
Tools, then open Local Security Policy Settings. Select Audit Policies, then
Audit Privilege Use. Check Failure, and click OK. Then close the windows.

You can test it by trying to ADJUST the system time as a limited user. After
that open the Event Viewer (as Admin) also in Administrative Tools from the
control panel. Choose Security Log, and look for a padlock icon in the list.
Double click that event for details.

<a few minutes later>

I did some experiments with a "User" account in XP Pro, trying to adjust the
system time, but not being able to do so, then assigning that right to my
test user, and doing it. The success audits showed up, but the failures did
not. Further, the Event Log was cluttered with many privilege use failures,
mostly "ScSeTcb," i.e., act as part of the OS.

It might be easier to take create a test account, and try assigning various
rights to it. Perhaps we get some help from someone more knowledgeable about
how these security events are handled.

Also if you only have one admin account, create another test account with
admin rights and try that. If the LED clock does NOT work, look for a
difference in configured startup programs.

If it does work, look to privileges.

HTH,

 

[Torgeir Bakken \(MVP\)]

I have a home computer that has a clock on LED panel of the computer case.
But the front panel clock doesn't update when logged in as a limited user.
Even though the system clock in the tray is updating as normal.

It does however, update correctly if logged in as an administrators account.
It also updates correctly if I "switch users" to a limited account while the
administrators account is running in the background.

The manufacturer is trying to resolve the problem but has no answer yet.

I'm leaning toward the access privelages for changing the system time as a
possible cause of the problem.

For security reasons, I don't want inexperienced users having administrator
rights. But I need a way to allow them access to change the system time.

Hi

For WinXP Pro and Win2k:

Start/Run --> gpedit.msc

Go to
Computer Configuration\Windows Settings\Security Settings
\Local Policies\User Rights Assignment\

Double click on "Change the system time". Add appropiate group/user.


You should be able to change the privilege with the Win2k3 resource
kit command line tool ntrights.exe as well, like this

ntrights.exe +r SeSystemtimePrivilege -u SomeUserorGroupNameHere


Ntrights.exe in the free Win2k3 resource kit works
on Win2k and WinXP as well:

Windows Server 2003 Resource Kit Tools
http://www.microsoft.com/downloads/...69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en

(The kit will install on WinXP or later, and you can copy relevant
files over to other computers)