Re: Time sync GPO users not members of local pc admin

By default, Win2K and later destktops should automatically update the time
at startup and whenever else the system thinks it's appropriate. Not sure
on 2K, but on XP you should see an event similar to the one pasted at the
bottom of this message, so you'll know it's working. If not, dig up the KB
on registry entries for the windows time service. Basically on the
workstations it's that in
HKLM\system\currentcontrolset\services\w32time\parameters, the Type entry
needs to be NT5DS.
http://support.microsoft.com/default.aspx?scid=kb;en-us;223184

As Max says, if the workstation time is off from the server time by more
than 5 minutes, kerberos won't allow you to log in.

You thought I wasn't going to answer your question, but you were wrong : -).
In the local security policy on the workstation, under User Rights
Assignment, you can set the policy called "change the system time." To do
it for all, just find the same setting in the domain security policy.

Here's the event you'd normally see at system startup and whenever else the
workstation wants to update its time to the server:

Event Type: Information
Event Source: W32Time
Event Category: None
Event ID: 35
Date: 5/18/2005
Time: 6:01:53 AM
User: N/A
Computer: XXXX
Description:
The time service is now synchronizing the system time with the time source
sbsserver.domain.local (ntp.d|10.0.0.16:123->10.0.0.2:123).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



"Bill Swan" <bill@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:OinDhCRXFHA.2540@xxxxxxxxxxxxxxxxxxxxxxx
> Reading my message again isn't quite clear.
>
> Would like to configure GPO to allow users to update time but not be
> member of local pc adminstrator...lol
>
> --
> www.smallbizserver.net (2000 and 2003)
>
> microsoft.public.backoffice.smallbiz2000 (2000 NG)
>
> microsoft.public.windows.server.sbs (2003 NG)
>
> http://groups.google.com/groups?hl=en&safe=off&group=microsoft.public.backoffice.smallbiz2000
>
> http://groups.google.com/groups?hl=en&lr=lang_en&ie=UTF-8&safe=off&group=microsoft.public.windows.server.sbs
>
> http://www.sbslinks.com/
>
> http://www.sbsmigration.com
> "Bill Swan" <bill@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:%23$Rcv5QXFHA.2776@xxxxxxxxxxxxxxxxxxxxxxx
>> Having problems trying to configure time sync on pcs where users are not
>> members of local pc administrator group.
>>
>> Suggestions how you would do it appreciated or ideas why it may not be
>> working.
>>
>> Cheers
>>
>> --
>> www.smallbizserver.net (2000 and 2003)
>>
>> microsoft.public.backoffice.smallbiz2000 (2000 NG)
>>
>> microsoft.public.windows.server.sbs (2003 NG)
>>
>> http://groups.google.com/groups?hl=en&safe=off&group=microsoft.public.backoffice.smallbiz2000
>>
>> http://groups.google.com/groups?hl=en&lr=lang_en&ie=UTF-8&safe=off&group=microsoft.public.windows.server.sbs
>>
>> http://www.sbslinks.com/
>>
>> http://www.sbsmigration.com
>>
>
>


.

Relevant Pages

  • Failed Logon Attempts
    ... to domain set a domain security policy ... lockout policies>>set account lockout threshold>> to 4 ... our servers for failed logon attempts. ... user 'joeblow' on workstation 'jowblowspc' between ...
    (microsoft.public.security)
  • Re: "Classic logon" screen in XP does not remeber the user name
    ... When I am at the server, ... and log onto a workstation, that workstation immediately goes to a locked ... John N ... "Local security policy does not allow interactive login on this ...
    (microsoft.public.windowsxp.security_admin)
  • Re: "Classic logon" screen in XP does not remeber the user name
    ... I went to the workstation. ... does not show up on the server when I log onto the ... as I get to the login screen of the ... "Local security policy does not allow interactive login on this machine". ...
    (microsoft.public.windowsxp.security_admin)
  • NTDBSMGR Handles are going crazy
    ... System cache: off ... 200 Dos clients running on Windows NT 4.0 Workstation or Windows XP sp2 ... increased from 1400 at startup to approx. ...
    (comp.databases.btrieve)
  • Re: password policy chnges
    ... A gpupdate /force on the workstation ... Changing the password length field to not defined in the Domain Security ... > Security policy. ...
    (microsoft.public.windows.server.active_directory)