windows domains

[gavpk]

Hi,
im playing around with windows server 2003 and exchange server (2 laptops, one as the server, DC, exchange server and the other laptop as a workstation on the domain), with not many issues, but for the life of me, cant allow a user to change the system time? can anyone explain how i can allow this or make any computer that logs into the domain have the system time sync with the server? ive added the user to all the admin groups and even logged into the workstation as admin of the domain and local computer, with no luck.

[ssrattus]

I am no expert but at work we are on a domain and I have admin rights and can change the time on the work station. Only couldn't when I was not an admin.

If you set up a time server on your domain you can get the remotes to sync with it. Have a look here for some ideas.


right at the end it says you need to disable windows time service to be able to adjust the time and have it stay at the new time... but I think your problem is you can't even adjust the time.

edit ... are you getting ""you do not have a proper privilege level to change the system time" or similar?

[ssrattus]

Something to check...

Start
Settings
Here's where to control this on an XP box.

Control Panel
Administrative Tools
Local Security Policy
Security Settings
Local Policies
User Rights Assignment
Change the System Time
Add or remove users as desired.

If you are running a 2000 box on an 2000 or 2003 domain, you can use global policies to define this. I don't think there's anywhere to control this on a 9x or stand-alone 2000 box.

from


and have a look at the group policies..

[gavpk]

thanks, the other laptop im using as a workstation is xp pro, i did try using this logon script "net time \\computername /set /yes" but didnt seem to work, "you do not have a proper privilege level to change the system time" thats what im getting when i try and change the system time,. When networking in a domain ,the server/DC controls all the permissions (IE: you shouldnt have to set any permissions on the local workstation) is this true?

cheers

[gavpk]

if i run gpedit.msc on the workstation, -->windows settings-->security settings-->local policies-->user rights assignment-->change the system time, this has a different icon than what your last post shows and if i double click it, the contents is greyed out? this led me to believe it is controlled by the server, not sure?

[ssrattus]

It should be! Below is what should happen when you are on the DC and editing group policies.

source:

Normally to edit the default domain controller policy you would

1. Start the Directory Management MMC (Start - Programs - Administrative Tools - Directory Management)
2. Select the domain and right click on "Domain Controllers" and select Properties
3. Select the 'Group Policy' tab
4. The policies in effect will be shown, normally 'Default Domain Controllers Policy". If you select it and click Edit the Group Policy editor MMC should start with "Default Domain Controllers Policy" as its root. You can then make changes

If when Group Policy Editor starts, you instead have "Local Policy" at the root the likely cause is the MMC start setting has been corrupted and this is usually caused by the installation of Office 2000. To repair perform the following:

1. Start the registry editor (regedit.exe)
2. Move to HKEY_CLASSES_ROOT\MSCFile\Shell\Open\Command
3. Double click on (Default)
4. If the line reads
D:\WINNT\System32\MMC.EXE "%1"
(your NT installation location may be different) Add %* to the end, e.g.
D:\WINNT\System32\MMC.EXE "%1" %*
5. Click OK

The policy editing should now work as expected. The basic problem is MMC was not being passed all the parameters and thus opening the default "Local policy".

_______________________________________________

Microsoft has a large server 2003 reference here:

Another ref:

[gavpk]

cheers mate , i will try this out when i get home from work, office 2000 may have been installed on the workstation laptop, but it has office 2003 pro on it ATM.

[gavpk]

It should be! Below is what should happen when you are on the DC and editing group policies.

source:

Normally to edit the default domain controller policy you would

1. Start the Directory Management MMC (Start - Programs - Administrative Tools - Directory Management)
2. Select the domain and right click on "Domain Controllers" and select Properties
3. Select the 'Group Policy' tab
4. The policies in effect will be shown, normally 'Default Domain Controllers Policy". If you select it and click Edit the Group Policy editor MMC should start with "Default Domain Controllers Policy" as its root. You can then make changes

If when Group Policy Editor starts, you instead have "Local Policy" at the root the likely cause is the MMC start setting has been corrupted and this is usually caused by the installation of Office 2000. To repair perform the following:

1. Start the registry editor (regedit.exe)
2. Move to HKEY_CLASSES_ROOT\MSCFile\Shell\Open\Command
3. Double click on (Default)
4. If the line reads
D:\WINNT\System32\MMC.EXE "%1"
(your NT installation location may be different) Add %* to the end, e.g.
D:\WINNT\System32\MMC.EXE "%1" %*
5. Click OK

The policy editing should now work as expected. The basic problem is MMC was not being passed all the parameters and thus opening the default "Local policy".

_______________________________________________

Microsoft has a large server 2003 reference here:

Another ref:

checked that and its all good, i can edit the group domain policy, BTW all of it was not defined? so if its not defined, what policy do the work stations go off? this one thing has taken me more time than it took to install server and exchange server from scratch

[ssrattus]

BTW all of it was not defined? so if its not defined, what policy do the work stations go off?

Whatever there own policies are I'd guess.

[gavpk]

alright, works now, active directory users and computers-->right click domain-->properties-->group policy-->options--> select "no override". the user is a member of domain users and domain admin, if i take domain admin away, cant change clock and other stuff, im still confused because ive forced the server to use the default policy but within that nothing is defined? so really a domain user should be able to change the time.
anyway i appriciate your help , thanks

Gav

[valuedcustomer]

Apart from experimenting, why would you every want a user to change the time in a working domain?

[gavpk]

Apart from experimenting, why would you every want a user to change the time in a working domain?

you would'nt, but the time was wrong on the user computer which means outlook for one had the wrong time, i can change it now, but it changes back to be 6 hours behind? i think there may be a problem with time syc, between the workstations and server, have another look tonight.

[valuedcustomer]

Check the time zone with the "w32tm /tz" command, and compare.

If variation, use "timezone.exe /s 02:0:4:10 02:0:1:04" for current daylight saving if needed. (Resource pack)

Check GPO applied to client:

Computer Configuration > Administrative Templates > System > window Time Service > Time Providers > Enable Windows NTP Client = Enabled
Computer Configuration > Administrative Templates > System > window Time Service > Time Providers > Configure Windows NTP Client = Enabled
NtpServer = time.windows.com,0x1
Type = NT5DS

[gavpk]

thanks VC, all fixed