Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to write a script that will remove all users under Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > User Rights Assignment > Change the system time from the local group policy (gpedit.msc) on all Windows XP machines. These machines are not on the domain. I DO have a way to distribute and run the script automatically. Can someone point me in the right direction for creating a script like this?

share|improve this question

Well, ignoring the fact that an administrator can just change it back.. ;)

The secedit tool should provide the functionality you need. Use /areas SECURITYPOLICY.

share|improve this answer
I know they can change it back, but they don't know how. I realize it's not the best idea to give users admin rights. Without going into detail, it's necessary in this instance. – user72128 Mar 9 '11 at 7:49
+1 for pointing out that administrators can change it back. – Ian Boyd Mar 12 '11 at 18:19

Late answer but may be useful. You also can try to do it using utility from Windows Server 2003 Resource Kit Tools ntrights.exe.

Example script (tested on Windows XP Professional SP3):

@echo off

echo Start process %date% %time% >> %~dp0%~n0.log

cd /d "c:\work"

rem Revokes "Change system time" right from Administrators
ntrights.exe -r SeSystemtimePrivilege -u "Administrators" >> %~dp0%~n0.log
rem Revokes "Change system time" right from Power users
ntrights.exe -r SeSystemtimePrivilege -u "Power Users" >> %~dp0%~n0.log
rem Revokes "Change system time" right from user2
ntrights.exe -r SeSystemtimePrivilege -u "user2" >> %~dp0%~n0.log
rem Grant "Change system time" right to user1
ntrights.exe +r SeSystemtimePrivilege -u "user1" >> %~dp0%~n0.log

echo End process %date% %time% >> %~dp0%~n0.log

rem Reboot if you need
shutdown /r /t 10
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.