3

I need to write a script that will remove all users under Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > User Rights Assignment > Change the system time from the local group policy (gpedit.msc) on all Windows XP machines. These machines are not on the domain. I DO have a way to distribute and run the script automatically. Can someone point me in the right direction for creating a script like this?

Improve this question

2 Answers 2

Reset to default
2

Well, ignoring the fact that an administrator can just change it back.. ;)

The secedit tool should provide the functionality you need. Use /areas SECURITYPOLICY.

Improve this answer
2
  • I know they can change it back, but they don't know how. I realize it's not the best idea to give users admin rights. Without going into detail, it's necessary in this instance.
    – user72128
    Mar 9, 2011 at 7:49
  • +1 for pointing out that administrators can change it back.
    – Ian Boyd
    Mar 12, 2011 at 18:19
1

Late answer but may be useful. You also can try to do it using utility from Windows Server 2003 Resource Kit Tools ntrights.exe.

Example script (tested on Windows XP Professional SP3):

@echo off

echo Start process %date% %time% >> %~dp0%~n0.log

cd /d "c:\work"

rem Revokes "Change system time" right from Administrators
ntrights.exe -r SeSystemtimePrivilege -u "Administrators" >> %~dp0%~n0.log
rem Revokes "Change system time" right from Power users
ntrights.exe -r SeSystemtimePrivilege -u "Power Users" >> %~dp0%~n0.log
rem Revokes "Change system time" right from user2
ntrights.exe -r SeSystemtimePrivilege -u "user2" >> %~dp0%~n0.log
rem Grant "Change system time" right to user1
ntrights.exe +r SeSystemtimePrivilege -u "user1" >> %~dp0%~n0.log

echo End process %date% %time% >> %~dp0%~n0.log

rem Reboot if you need
shutdown /r /t 10
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .