Prevent users on local workstations from changing the time
-
Is there a way via group policy to prevent the users from changing the time on their workstations?
I know, don't make them administrators, but I do not have a choice. Lazy software designer made a program that the user must have local administrator access.
I see this fix here, but don't know if it can be done via GPO...
https://www.sevenforums.com/tutorials/113557-date-time-allow-prevent-users-groups-changing.html
-
There is no, there is nothing you can do to stop an admin on a box. GPO cannot override an admin.
-
Even if the link I posted was put into place on each PC?
(I know an admin could change it but it may keep the dumb one's from doing it.)
-
@ccwtech said in Prevent users on local workstations from changing the time:
Even if the link I posted was put into place on each PC?
(I know an admin could change it but it may keep the dumb one's from doing it.)
You can make it annoying, but they can just look it up and change it
You have no power that they don''t have, is the fundamental problem. -
@ccwtech said in Prevent users on local workstations from changing the time:
Is there a way via group policy to prevent the users from changing the time on their workstations?
I know, don't make them administrators, but I do not have a choice. Lazy software designer made a program that the user must have local administrator access.
I see this fix here, but don't know if it can be done via GPO...
https://www.sevenforums.com/tutorials/113557-date-time-allow-prevent-users-groups-changing.html
If you have a domain and you setup the time over GPO and all the computers are joined to the domain, the time wilk be taken from the DC. No matter how many times the person changes the time, the time is reverted back to the DC times in less than 5 minutes.
-
@dbeato Yes, but they move the clock back 10 minutes, clock in, and then they move it back to the real time.
-
@ccwtech said in Prevent users on local workstations from changing the time:
@dbeato Yes, but they move the clock back 10 minutes, clock in, and then they move it back to the real time.
Maybe move the clock in and out machine to something external to your computers then. We have PayClocks.
-
@ccwtech said in Prevent users on local workstations from changing the time:
@dbeato Yes, but they move the clock back 10 minutes, clock in, and then they move it back to the real time.
Wow. That's both incredibly bad from an ethics standpoint, and also from a timeclock one. The timeclock just accepts any arbitrary remote client's claim to the time?
-
For something like this, those people will definitely make an effort to find away around any system that you put in place. This isn't casual disruption, this is seriously intentional fraud going on.
-
Even if I could get an alert or email when any of the times were manually changed....
Some people will be out of a job soon but want to see what can be done to prevent/detect it...
-
@ccwtech said in Prevent users on local workstations from changing the time:
Even if I could get an alert or email when any of the times were manually changed....
Some people will be out of a job soon but want to see what can be done to prevent/detect it...
Time can’t really be detected from inside a system. Only from outside. Because the system can’t tell that time is changing. It has no means of observing it.
-
So an external system that monitors the time could work. But it would be simpler to just get a functional time clock system. Recording the time externally is definitely the easy answer.
-
@scottalanmiller said in Prevent users on local workstations from changing the time:
So an external system that monitors the time could work. But it would be simpler to just get a functional time clock system. Recording the time externally is definitely the easy answer.
Agreed!
-
@ccwtech said in Prevent users on local workstations from changing the time:
@dbeato Yes, but they move the clock back 10 minutes, clock in, and then they move it back to the real time.
The backend should be the one setting the time when saving to the db. Why accept the time from the clients if it could easily be modified like this.
-
@romo said in Prevent users on local workstations from changing the time:
@ccwtech said in Prevent users on local workstations from changing the time:
@dbeato Yes, but they move the clock back 10 minutes, clock in, and then they move it back to the real time.
The backend should be the one setting the time when saving to the db. Why accept the time from the clients if it could easily be modified like this.
Yes, the program is supposed to pull the server time but is not doing that for some reason. I am working on that angle as well.
-
@ccwtech said in Prevent users on local workstations from changing the time:
@romo said in Prevent users on local workstations from changing the time:
@ccwtech said in Prevent users on local workstations from changing the time:
@dbeato Yes, but they move the clock back 10 minutes, clock in, and then they move it back to the real time.
The backend should be the one setting the time when saving to the db. Why accept the time from the clients if it could easily be modified like this.
Yes, the program is supposed to pull the server time but is not doing that for some reason. I am working on that angle as well.
Probably triggers NTP from time to time and they hit it in between the cycles.
-
