OT: NT/2k administrators - need some advice

[IndyJaws]

I posted this in the OS forum as well, but know that there are a lot of knowledgeable people in our forum that might be able to answer a hopefully simple question:

Being that I live in Indiana, a state too backwards to use daylight savings time, we inevitably have some machines at work that change time in April, due to the person who originally set up the PC forgetting to set the right time zone. Unfortunately, the standard user logon permissions don't allow modification of the time or date, and the help desk gets the call. Is there a permissions level that I can create that would only allow the modification of time/date without giving them other capabilities? It could even be a separate logon that they would use when needing to change the time/date.

Let me know if you need any more info.

🙂

 

[IJump]

If you use login scripts, you could have the local computer get the time from the server at each login. NET TIME \\SERVER /SET /YES is the command I use. That will adjust the time and you only have to worry about what is on the server. That is how I have my scripts set up and it seems to work fine. Just one idea.

 

[Migroo]

Nice solution IJump 🙂

<-- Is learning

 

[LastKnight]

I believe the net time command only works if they are administrators of the local workstations. There may be a right you can grant on the local workstation that allows this to happen without giving them full admin rights locally, but I'm not sure. I'm pretty sure, however, that if they aren't admins locally, the script doesn't work correctly.

I generally give admin rights to the machine, and make them aware that if they screw it up, they get ghosted pretty quickly.

Perhaps you could set up a local admin login that has full rights to the machine, but no rights to your network (so they're not tempted to just stay as the local admin), and only run the net time command if they log in under that ID?

 

[networkman]

On the workstations you could always use a program like D4 to keep in sync with a time-server on your network. 🙂

 

[BitSpit]

For NT Server:

Administrative Tools > User Manager > Policies > User Rights > Right > Change system time

Hit the add button and select the users or groups you want to be able to change the time.

 

[RustyNale]

For win2k, start->programs-->administrator tools-->local security policy-->local policy-->user rights--> change system time--right click-->security--> add user.

 

[Baldy18]

You could train the people that setup your workstations to not be so careless.

 

[Slahr Dzhe]

If you set up your login scripts correctly, they will be run with system rights regardless of the user login credentials. 🙂

There is also 3rd party software available to automate tasks like these, but they cost money. 😱

SD

 

[IndyJaws]

Originally posted by: RustyNale
For win2k, start->programs-->administrator tools-->local security policy-->local policy-->user rights--> change system time--right click-->security--> add user.

That's it! 🙂

When we upgraded from NT Server to 2K Server, we forgot to make that change. That fixed the problem! 🙂

Originally posted by: Baldy18
You could train the people that setup your workstations to not be so careless.

I couldn't agree more. 🙁

However training is not the solution. Corporal punishment is.

 

[SoulAssassin]

The BOFH would just tell the users to look at their damn watch and stop complaining. 🙂

 

[Baldy18]

Originally posted by: SoulAssassin
The BOFH would just tell the users to look at their damn watch and stop complaining. 🙂

Problem is that policy has it that certain user groups can't sign in during certain times of the day. This is for security reasons. So now that daylight savings time has taken effect on the computers (but not in everyday life for hoosiers) they can't do any work on the computer for their first hour at the office.

I agree on the corpral punnishment, or maybe capital punishment. They could be sent for "training" at the state pen in Michigan City.