itdude59 Posted February 21, 2006 Share Posted February 21, 2006 I would like to know if their is a program that can keep track of when the computer's time has been changed. Our employees clock their time in and out on a PC and we suspect that a few may be changing the time back to fool the punch clock program. I've tryed "Clock Guard", it locks the clock from being changed but doesn't report attempts. If any of you guys know of a program, or place I can look in windows, I would appreciate the feedback. All of our pc's with the puch in/out software are XP Pro, btw. Link to comment Share on other sites More sharing options...
jondercik Posted February 21, 2006 Share Posted February 21, 2006 Remove their admin rights to the machine. And any good app will get its time from the server not the client.To watch when the time is changed enable auditing on the local security policy of use of user rights.Jim Link to comment Share on other sites More sharing options...
N1K Posted February 21, 2006 Share Posted February 21, 2006 Yes, you can determine who changed the system clock and what values the date and time were changed from and to. The information is in the Windows Security log. The Security log in Windows Server 2003 has a new event ID that gives you all this information in one event, but you can also obtain the same information in Windows versions prior to Windows 2003.The Windows 2003 event is event ID 520 (The system time was changed) in the System Event category. As you can see in the example in Figure 1, event ID 520's Primary and Client fields tell you who changed the system time. Sometimes, the Primary fields might list the local computer as the user who changed the time, but if a user changed the time, the Client fields will identify him or her. If no user—only the local system—appears in either the Primary or Client fields, the system changed the time as a result of the Windows Time service synchronizing with a time server. All computers in an Active Directory (AD) forest synchronize with the forest time server, which defaults to the first domain controller (DC) in the forest root domain. The meaning of the Previous Time and New Time fields is obvious. The Process fields identify the program that executed the change. . . .There is another option to deny system time change by removing users from Admin group.. Link to comment Share on other sites More sharing options...
itdude59 Posted February 21, 2006 Author Share Posted February 21, 2006 (edited) Thanks much. Where did you grab that quote from? I would like to see the figures it refers to.Edit: Just googled and found the article Edited February 21, 2006 by itdude59 Link to comment Share on other sites More sharing options...
N1K Posted February 22, 2006 Share Posted February 22, 2006 Edit: Just googled and found the articleI did the same B) Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now