Windows Date and Time

[itdude59]

I would like to know if their is a program that can keep track of when the computer's time has been changed. Our employees clock their time in and out on a PC and we suspect that a few may be changing the time back to fool the punch clock program. I've tryed "Clock Guard", it locks the clock from being changed but doesn't report attempts. If any of you guys know of a program, or place I can look in windows, I would appreciate the feedback. All of our pc's with the puch in/out software are XP Pro, btw.

[jondercik]

Remove their admin rights to the machine. And any good app will get its time from the server not the client.

To watch when the time is changed enable auditing on the local security policy of use of user rights.

Jim

[N1K]

Yes, you can determine who changed the system clock and what values the date and time were changed from and to. The information is in the Windows Security log. The Security log in Windows Server 2003 has a new event ID that gives you all this information in one event, but you can also obtain the same information in Windows versions prior to Windows 2003.

The Windows 2003 event is event ID 520 (The system time was changed) in the System Event category. As you can see in the example in Figure 1, event ID 520's Primary and Client fields tell you who changed the system time. Sometimes, the Primary fields might list the local computer as the user who changed the time, but if a user changed the time, the Client fields will identify him or her. If no user—only the local system—appears in either the Primary or Client fields, the system changed the time as a result of the Windows Time service synchronizing with a time server. All computers in an Active Directory (AD) forest synchronize with the forest time server, which defaults to the first domain controller (DC) in the forest root domain. The meaning of the Previous Time and New Time fields is obvious. The Process fields identify the program that executed the change. . . .

There is another option to deny system time change by removing users from Admin group..

[itdude59]

Thanks much. Where did you grab that quote from? I would like to see the figures it refers to.

Edit: Just googled and found the article

Edited February 21, 2006 by itdude59

[N1K]

Edit: Just googled and found the article

I did the same B)