Administrator Accounts in WinXP

I just got hired (part time) at my university's IT department. We take care of few of the university's computers (some computer labs and the atheltics department computers); one of my cowerkers was asking me about being able to change the date and time in XP (bottom right corner in the task bar) while not in the administrator account.

All the computers that we take care of are ran in restricted accounts, and only we have access to them as administrators (I hope I am making sense so far). So one of our clients just wants to know how he is able to change the time on his computer in the office (and he does not have rights as an administrator). What can I do about that? I am hoping that there is a setting that I can change while under the administrator account that would allow restricted accounts to be able to do so.

Also, same question regarding defragmenting. I was telling one of the clients to defrag the harddrive, and he replied by saying that an message popped up saying that only administrators are allowed to do so.

Does anyone have any clues as to how to allow these two settings for restricted accounts? If I am not clear enough, let me know. Thanks in advance.

Press windows+r and type secpol.msc and hit enter.

Expand local policies, then select user rights assignment. Select change the system time and make sure the client's user group is added to the list - you will see administrator listed there already.

There is also an option there for "perform volume maintenance tasks" which may apply to defragmentation, let me know how it goes if you try it.

Good questions, didn't know how to do this until I just tried... Generally if you are looking to manage a PC and do not know where to find something, I keep a folder with shortcuts to all of the msc extension files. You can find these by doing a search on all files and folders and looking for "*.msc". These files are useful group of management tools

Excellent advice... I don't work again until Friday, so I will have to try it then. Thank you very much

is that for xp pro only? secpol.msc doesn't work on my xp home.......

seems like a sweet utility though!

mdameron said:

is that for xp pro only? secpol.msc doesn't work on my xp home.......

seems like a sweet utility though!

Click to expand...

XP Home doesn't come with the Security Policy Editor (secpol.msc) ...it's only available in the Pro version.

I would think twice about changing security policies already in place. There is most likely a reason they are in place. You, a new part time employee with the power to change policies, doesn't mean you should. Talk to your supervisor before you do anything.

jajmon said:

I would think twice about changing security policies already in place. There is most likely a reason they are in place. You, a new part time employee with the power to change policies, doesn't mean you should. Talk to your supervisor before you do anything.

Click to expand...

I agree. Just tell the users that if they need anything changed or require any maintenance to just call/page you. That's your job.

You wouldn't want to get chewed out by someone above you that wanted the restrictions in place. So play it safe. Either make the changes yourself, or contact your super to see if its cool to give them the priveledges.

A good example of why allowing the time to be changed could be a problem is if there are local tasks that run - such as looking for updates at a certain time or jobs that need to run at a certain time.

redduc900 said:

XP Home doesn't come with the Security Policy Editor (secpol.msc) ...it's only available in the Pro version.

Click to expand...

While this is true, it is possible to make the same changes, but they would have to be done manually through the registry, and you don't get the handy management interfaces, right? Behind the scenes, that is all these tools do?

I mean, there isn't any other factor that would prevent you from implementing these - its just very inconvenient to do it in home? Is that accurate?

AFAIK, XP Home doesn't support the Local Security facilities by any means (including editing of the Registry). I know it's possible to alter XP Pro type Group Policy settings in the Home version (even though the GPE isn't supported) by editing certain Registry entries. One program that I know of for doing just that, without the hassle of having to manually edit the Registry, is available from Doug Knox's site here...

Windows XP Security Console
http://www.dougknox.com/xp/utils/xp_securityconsole.htm

When you're outside of a domain environment, XP has some features missing. XP Home leaves you completely without the Group Policy Editor, while XP Pro lacks the ability to use the Group Policy Editor to selectively apply policies to specific users.

Click to expand...

Gotcha, I think. It was just a curiousity, and figured yours would be the brain to pick.

jajmon said:

I would think twice about changing security policies already in place. There is most likely a reason they are in place. You, a new part time employee with the power to change policies, doesn't mean you should. Talk to your supervisor before you do anything.

Click to expand...

relax bud... One of my cowerkers was discussing it with me, and she didn't know how, so I thought I would be nice and find out for her

And thanks for all the input guys.

See if you can get permission to run folding @ home on the computers...

I'm on Win2k here at work. I just looked at the secpol.msc file. Under "Local Policies -> User Rights Assignments" there is an option for "Change the System Time" and you can specify groups able to do that. Don't know if this is possible under XP, too.

Stoanhart said:

I'm on Win2k here at work. I just looked at the secpol.msc file. Under "Local Policies -> User Rights Assignments" there is an option for "Change the System Time" and you can specify groups able to do that. Don't know if this is possible under XP, too.

Click to expand...

This works in w2k and XP:

I.M.O.G. said:

Press windows+r and type secpol.msc and hit enter.

Expand local policies, then select user rights assignment. Select change the system time and make sure the client's user group is added to the list - you will see administrator listed there already.

There is also an option there for "perform volume maintenance tasks" which may apply to defragmentation, let me know how it goes if you try it.

Good questions, didn't know how to do this until I just tried... Generally if you are looking to manage a PC and do not know where to find something, I keep a folder with shortcuts to all of the msc extension files. You can find these by doing a search on all files and folders and looking for "*.msc". These files are useful group of management tools

Click to expand...

You have to learn how to say no or it will come back to bite you in the butt.