gavpk

Hi,
im playing around with windows server 2003 and exchange server (2 laptops, one as the server, DC, exchange server and the other laptop as a workstation on the domain), with not many issues, but for the life of me, cant allow a user to change the system time? can anyone explain how i can allow this or make any computer that logs into the domain have the system time sync with the server? ive added the user to all the admin groups and even logged into the workstation as admin of the domain and local computer, with no luck.

ssrattus

I am no expert but at work we are on a domain and I have admin rights and can change the time on the work station. Only couldn't when I was not an admin.

If you set up a time server on your domain you can get the remotes to sync with it. Have a look here for some ideas. Windows Domain


right at the end it says you need to disable windows time service to be able to adjust the time and have it stay at the new time... but I think your problem is you can't even adjust the time.

edit ... are you getting ""you do not have a proper privilege level to change the system time" or similar?

ssrattus

Something to check...


from Computing.Net - Prevent changing time


and have a look at the group policies.. How To: Prevent users changing Windows settings

gavpk

thanks, the other laptop im using as a workstation is xp pro, i did try using this logon script "net time \\computername /set /yes" but didnt seem to work, "you do not have a proper privilege level to change the system time" thats what im getting when i try and change the system time,. When networking in a domain ,the server/DC controls all the permissions (IE: you shouldnt have to set any permissions on the local workstation) is this true?

cheers

gavpk

if i run gpedit.msc on the workstation, -->windows settings-->security settings-->local policies-->user rights assignment-->change the system time, this has a different icon than what your last post shows and if i double click it, the contents is greyed out? this led me to believe it is controlled by the server, not sure?

ssrattus

It should be! Below is what should happen when you are on the DC and editing group policies.

source: When I try and edit the default domain controller policy from Directory Management MMC the local policy is shown, why?

Normally to edit the default domain controller policy you would

1. Start the Directory Management MMC (Start - Programs - Administrative Tools - Directory Management)
2. Select the domain and right click on "Domain Controllers" and select Properties
3. Select the 'Group Policy' tab
4. The policies in effect will be shown, normally 'Default Domain Controllers Policy". If you select it and click Edit the Group Policy editor MMC should start with "Default Domain Controllers Policy" as its root. You can then make changes

If when Group Policy Editor starts, you instead have "Local Policy" at the root the likely cause is the MMC start setting has been corrupted and this is usually caused by the installation of Office 2000. To repair perform the following:

1. Start the registry editor (regedit.exe)
2. Move to HKEY_CLASSES_ROOT\MSCFile\Shell\Open\Command
3. Double click on (Default)
4. If the line reads
D:\WINNT\System32\MMC.EXE "%1"
(your NT installation location may be different) Add %* to the end, e.g.
D:\WINNT\System32\MMC.EXE "%1" %*
5. Click OK

The policy editing should now work as expected. The basic problem is MMC was not being passed all the parameters and thus opening the default "Local policy".

_______________________________________________

Microsoft has a large server 2003 reference here: Overview to the Windows Server 2003 Security Guide

Another ref: Troubleshooting Group Policy Processing

gavpk

cheers mate , i will try this out when i get home from work, office 2000 may have been installed on the workstation laptop, but it has office 2003 pro on it ATM.

gavpk

checked that and its all good, i can edit the group domain policy, BTW all of it was not defined? so if its not defined, what policy do the work stations go off? this one thing has taken me more time than it took to install server and exchange server from scratch

ssrattus

Whatever there own policies are I'd guess.

gavpk

alright, works now, active directory users and computers-->right click domain-->properties-->group policy-->options--> select "no override". the user is a member of domain users and domain admin, if i take domain admin away, cant change clock and other stuff, im still confused because ive forced the server to use the default policy but within that nothing is defined? so really a domain user should be able to change the time.
anyway i appriciate your help , thanks

Gav

valuedcustomer

Apart from experimenting, why would you every want a user to change the time in a working domain?

gavpk

you would'nt, but the time was wrong on the user computer which means outlook for one had the wrong time, i can change it now, but it changes back to be 6 hours behind? i think there may be a problem with time syc, between the workstations and server, have another look tonight.

valuedcustomer

Check the time zone with the "w32tm /tz" command, and compare.

If variation, use "timezone.exe /s 02:0:4:10 02:0:1:04" for current daylight saving if needed. (Resource pack)

Check GPO applied to client:

Computer Configuration > Administrative Templates > System > window Time Service > Time Providers > Enable Windows NTP Client = Enabled
Computer Configuration > Administrative Templates > System > window Time Service > Time Providers > Configure Windows NTP Client = Enabled
NtpServer = time.windows.com,0x1
Type = NT5DS

gavpk

thanks VC, all fixed