I need to write a script that will remove all users under Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > User Rights Assignment > Change the system time
from the local group policy (gpedit.msc) on all Windows XP machines. These machines are not on the domain. I DO have a way to distribute and run the script automatically. Can someone point me in the right direction for creating a script like this?
Add a comment
|
2 Answers
Well, ignoring the fact that an administrator can just change it back.. ;)
The secedit tool should provide the functionality you need. Use /areas SECURITYPOLICY
.
-
I know they can change it back, but they don't know how. I realize it's not the best idea to give users admin rights. Without going into detail, it's necessary in this instance. Mar 9, 2011 at 7:49
-
Late answer but may be useful. You also can try to do it using utility from Windows Server 2003 Resource Kit Tools ntrights.exe.
Example script (tested on Windows XP Professional SP3):
@echo off
echo Start process %date% %time% >> %~dp0%~n0.log
cd /d "c:\work"
rem Revokes "Change system time" right from Administrators
ntrights.exe -r SeSystemtimePrivilege -u "Administrators" >> %~dp0%~n0.log
rem Revokes "Change system time" right from Power users
ntrights.exe -r SeSystemtimePrivilege -u "Power Users" >> %~dp0%~n0.log
rem Revokes "Change system time" right from user2
ntrights.exe -r SeSystemtimePrivilege -u "user2" >> %~dp0%~n0.log
rem Grant "Change system time" right to user1
ntrights.exe +r SeSystemtimePrivilege -u "user1" >> %~dp0%~n0.log
echo End process %date% %time% >> %~dp0%~n0.log
rem Reboot if you need
shutdown /r /t 10