How to Lock PC Clock and Date in XP pro ?

  • Thread starter Thread starter sylvester_k
  • Start date Start date
S

sylvester_k

Hi all,

I have a standalone PC running under XP PRO - adminstrator account.
Pls advice how can I can lock the PC time and date so that
others (using the PC also in adm. mode) is not able change it easily.

I am not able to create additional restricted account as I am havin this
software application that works properly only in adminstrator mode which
other user needs to use them regularly.

I am also aware that I can set some form of user permissions/restrictions
with
Group Policy (Start>Run>gpedit.msc [enter]) - can I achieve the above
with this ?

If yes, as I am total new to gpedit, can anyone link me to some procedure
to set the above PC clock & date ?

Is there any freeware / software that can achieve this ? Kindly recommend.

Thanks in advance.

With Regards
Sylvester
 
sylvester_k said:
Hi all,

I have a standalone PC running under XP PRO - adminstrator account.
Pls advice how can I can lock the PC time and date so that
others (using the PC also in adm. mode) is not able change it
easily.
Click to expand...


Explain how just YOU could be permitted to change the clock. You are
nothing more than just another admin-level user. You get the same
privileges as any other admin. If you don't want others to have the
same privileges as you then don't give them those privileges. Stop
giving everyone an admin-level account.
 
sylvester_k said:
I have a standalone PC running under XP PRO - adminstrator account.
Pls advice how can I can lock the PC time and date so that
others (using the PC also in adm. mode) is not able change it
easily.
Click to expand...

An administrator can do anything. You have cancelled out your own request.
I am not able to create additional restricted account as I am havin
this software application that works properly only in adminstrator
mode which other user needs to use them regularly.
Click to expand...

Replace the application at the earliest possible time and/or get with the
manufacturer and find out what it actually needs access to.
I am also aware that I can set some form of user
permissions/restrictions with
Group Policy (Start>Run>gpedit.msc [enter]) - can I achieve the
above with this ?
Click to expand...

A local administrator can do whatever they want to the local machine.
Period.
 
Being that they are Administrators they can undo whatever it is that you
do, so there is only so much that you can do and hope that they aren't
clever enough to figure out how to undo what it is that you did.

Change the Security Permissions on the timedate.cpl file in the System32
folder. Deny Read & Execute as well as Read permissions for the
Administrator group and they won't be able to launch the applet to
change the time or date. Of course it's only a matter of time before
they figure out what is going on. If you want to make it a bit more
difficult for them to change it you can remove all the users from the
permissions and give ownership to yourself only, then only you will be
able to change any of the permission. Only you that is... plus the
System account, if the others are clever enough they will soon figure
out how to use the System account to change the permissions.

John
 
Dear All Thanks everyone for the prompt reply,

1. I have ever tried to ask software vendor to for non-adm access
but it seem that it will be problematic in certain issue if we do so
.... so I have sort of accepted the fact. I think they have experience
system bug when doing so...

2. I will try on the timedate.cpl file in the System32 folder.
Revert back asap.

3. If they rest is able to break through - unless they come across this
forum !
I will need to look for a software to require seperate password access
when anyone needs to change the system time and date.
Currently there is no password access into the adm account.

Thanks everyone !
Sylvester-k

John John said:
Being that they are Administrators they can undo whatever it is that you
do, so there is only so much that you can do and hope that they aren't
clever enough to figure out how to undo what it is that you did.

Change the Security Permissions on the timedate.cpl file in the System32
folder. Deny Read & Execute as well as Read permissions for the
Administrator group and they won't be able to launch the applet to
change the time or date. Of course it's only a matter of time before
they figure out what is going on. If you want to make it a bit more
difficult for them to change it you can remove all the users from the
permissions and give ownership to yourself only, then only you will be
able to change any of the permission. Only you that is... plus the
System account, if the others are clever enough they will soon figure
out how to use the System account to change the permissions.

John

sylvester_k said:
Hi all,

I have a standalone PC running under XP PRO - adminstrator account.
Pls advice how can I can lock the PC time and date so that
others (using the PC also in adm. mode) is not able change it easily.

I am not able to create additional restricted account as I am havin this
software application that works properly only in adminstrator mode which
other user needs to use them regularly.

I am also aware that I can set some form of user permissions/restrictions
with
Group Policy (Start>Run>gpedit.msc [enter]) - can I achieve the above
with this ?

If yes, as I am total new to gpedit, can anyone link me to some procedure
to set the above PC clock & date ?

Is there any freeware / software that can achieve this ? Kindly recommend.

Thanks in advance.

With Regards
Sylvester
Click to expand...
Click to expand...
 
You're welcome. And on the Ownership of the file, that I mentioned in
my other post, I must have been half asleep when I wrote that, if the
other users are administrators they will be able to seize ownership of
the file and do as they please with it.

John

sylvester_k said:
Dear All Thanks everyone for the prompt reply,

1. I have ever tried to ask software vendor to for non-adm access
but it seem that it will be problematic in certain issue if we do so
.... so I have sort of accepted the fact. I think they have experience
system bug when doing so...

2. I will try on the timedate.cpl file in the System32 folder.
Revert back asap.

3. If they rest is able to break through - unless they come across this
forum !
I will need to look for a software to require seperate password access
when anyone needs to change the system time and date.
Currently there is no password access into the adm account.

Thanks everyone !
Sylvester-k

:

Being that they are Administrators they can undo whatever it is that you
do, so there is only so much that you can do and hope that they aren't
clever enough to figure out how to undo what it is that you did.

Change the Security Permissions on the timedate.cpl file in the System32
folder. Deny Read & Execute as well as Read permissions for the
Administrator group and they won't be able to launch the applet to
change the time or date. Of course it's only a matter of time before
they figure out what is going on. If you want to make it a bit more
difficult for them to change it you can remove all the users from the
permissions and give ownership to yourself only, then only you will be
able to change any of the permission. Only you that is... plus the
System account, if the others are clever enough they will soon figure
out how to use the System account to change the permissions.

John

sylvester_k wrote:

Hi all,

I have a standalone PC running under XP PRO - adminstrator account.
Pls advice how can I can lock the PC time and date so that
others (using the PC also in adm. mode) is not able change it easily.

I am not able to create additional restricted account as I am havin this
software application that works properly only in adminstrator mode which
other user needs to use them regularly.

I am also aware that I can set some form of user permissions/restrictions
with
Group Policy (Start>Run>gpedit.msc [enter]) - can I achieve the above
with this ?

If yes, as I am total new to gpedit, can anyone link me to some procedure
to set the above PC clock & date ?

Is there any freeware / software that can achieve this ? Kindly recommend.

Thanks in advance.

With Regards
Sylvester
Click to expand...
Click to expand...
Click to expand...
 
Thanks for the recommendation.

As per previous email, I have tried on 2 standalone PC both with XP pro.
When I right-click on timedate.cpl -> properties ->
On one PC there is a security option where I can set Deny Read & Execute
as in John's advice.
On the other PC, however there is no security option for setting.

Why is it so when both is Win XP Pro ?

Kindly advice.




Byte said:
Clock Guard software to prevent changing or tampering with the system clock.
You set it with your own password. It is free for one month, $20 thereafter.
http://members.aol.com/Leithauser/cg.html

--
XP - WNP
Today is the first day of the
rest of your life.



sylvester_k said:
Hi all,

I have a standalone PC running under XP PRO - adminstrator account.
Pls advice how can I can lock the PC time and date so that
others (using the PC also in adm. mode) is not able change it easily.

I am not able to create additional restricted account as I am havin this
software application that works properly only in adminstrator mode which
other user needs to use them regularly.

I am also aware that I can set some form of user permissions/restrictions
with
Group Policy (Start>Run>gpedit.msc [enter]) - can I achieve the above
with this ?

If yes, as I am total new to gpedit, can anyone link me to some procedure
to set the above PC clock & date ?

Is there any freeware / software that can achieve this ? Kindly recommend.

Thanks in advance.

With Regards
Sylvester
Click to expand...
Click to expand...
 
sylvester_k said:
I have a standalone PC running under XP PRO - adminstrator account.
Pls advice how can I can lock the PC time and date so that
others (using the PC also in adm. mode) is not able change it
easily.

I am not able to create additional restricted account as I am havin
this software application that works properly only in adminstrator
mode which other user needs to use them regularly.

I am also aware that I can set some form of user
permissions/restrictions with
Group Policy (Start>Run>gpedit.msc [enter]) - can I achieve the
above with this ?

If yes, as I am total new to gpedit, can anyone link me to some
procedure to set the above PC clock & date ?

Is there any freeware / software that can achieve this ? Kindly
recommend.
Click to expand...
Clock Guard software to prevent changing or tampering with the
system clock. You set it with your own password. It is free for
one month, $20 thereafter. http://members.aol.com/Leithauser/cg.html
Click to expand...

sylvester_k said:
As per previous email, I have tried on 2 standalone PC both with XP
pro. When I right-click on timedate.cpl -> properties ->
On one PC there is a security option where I can set Deny Read &
Execute as in John's advice.
On the other PC, however there is no security option for setting.

Why is it so when both is Win XP Pro ?
Click to expand...

This is a newsgroup - if you emailed, that may not have made it to the
newsgroup.

As you were told earlier - this is really no good. You have all
administrators on your system - others can get around it and *no* - they do
not necessarily need to come here to do so. Heck - they do not even to use
the OS to change the time since they have physical access to the computer
and I asume since there is little to no OS security involved - the physical
security is similar. ;-)

Are both formatted with FAT32?
Are you logged in as a user with System Administrator on both?

Who are the users of this mystery computer where you have to be an
administrator to run an application (what application - BTW? Tried
filemon/regmon to see what it actually accesses and gave full rights to
those directories/registry keys?)?
 
sylvester_k said:
Thanks for the recommendation.
Click to expand...

Clock Guard. "as long as Clock Guard is installed and active, you
cannot change the time/date provided by the system clock". A waste of
$20 since ANY user can terminate that process, and any admin can
uninstall it or modify the Start menu and Run registry key to
obliterate this utility, or delete its file(s), like
\windows\lrrpfgcp.exe, or reboot into safe mode to eliminate its load
on Windows startup. Then there is having to suffer the defects of
this problem, like it preventing any use of Start -> Run or opening a
DOS shell.

If you permit other users to be administrators then they have the SAME
priviliges as YOU.
As per previous email, I have tried on 2 standalone PC both with XP
pro.
When I right-click on timedate.cpl -> properties ->
On one PC there is a security option where I can set Deny Read &
Execute
as in John's advice.
Click to expand...

And John also mentioned that any other admin could easily thwart that
permissions denial by simply changing permissions to whatever they
want. The admin user will get a permission denial. So what do you
think their next action will be? You could delay them by maybe
another 10 minutes by defining a software restriction policy (use
secpol.msc) that prevents running the time applet but if they really
are admins then they can also delete that software policy.
On the other PC, however there is no security option for setting.
Why is it so when both is Win XP Pro ?
Click to expand...

If you are using FAT on the other host then you don't get any security
permissions with that file system. You need to use NTFS to have
file-level security permissions.

Also, under Folder Options -> View, do you have "simple file sharing"
enabled? If so, the Security tab won't be shown.
 
VanguardLH said:
Clock Guard. "as long as Clock Guard is installed and active, you
cannot change the time/date provided by the system clock". A waste of
$20 since ANY user can terminate that process, and any admin can
uninstall it or modify the Start menu and Run registry key to obliterate
this utility, or delete its file(s), like \windows\lrrpfgcp.exe, or
reboot into safe mode to eliminate its load on Windows startup. Then
there is having to suffer the defects of this problem, like it
preventing any use of Start -> Run or opening a DOS shell.
Click to expand...

I see you installed and tried it too ;-) It isn't too hard to work
around it! It might keep the clueless at bay, but any user with 5 cents
worth of brains will figure their way around it in less than two minutes!

John
 
in message
I see you installed and tried it too ;-)
Click to expand...
Tis the beauty of virtual machines. I use VMware Server (free). Has
a snapshot feature missing in Microsoft's Virtual PC (also free) and
includes support for USB devices. Then when you are done testing the
unknown software, you simply revert back to the baseline snapshot.
You don't even have to uninstall the crap. Does require that you have
another license of Windows, however, though I doubt Microsoft is going
to send their lawyer police at you for using it as a temporary
sandbox. There are ShadowUser (or its sibling ShadowSurfer),
Microsoft's SteadyState, and other similar save-state programs out
there that don't require another Windows license but you have to let
the unknown software play around in your production environment and
hope these products return it back to your baseline or prior state.
 
Back
Top