It's in Group Policy (or Local Computer Policy for stand alone
machines.)
Under Computer Configuration / Windows Settings / Security Settings /
Local Policies / User Rights Assignment there is a "Change System Time"
right where you can list users/groups that are allowed to change time --
so eg remove all but administrators.