Security Basics mailing list archives
Re: Group policy help
From: Kirk Schafer <infosec-capital () rainswept com>
Date: Tue, 19 Oct 2004 10:52:33 -0500
Peter,I've looked around; this change being ineffective seems to be a common problem. Perhaps the answer is that there are more changes made to the registry than just the "Disable..." parameter. Here are two registry dumps before and after setting "Central Daylight Time." If you're just turning off "DisableAutoDaylight", you may also have to update the other "Daylight..." keys, as well as the "ActiveTimeBias" key.
Warning: I haven't tested this, because I'm pressed for time. If you choose to explore this, you should (compare your findings, and) export relevant registry keys before you make changes. This page should also help you:
http://www.jsiinc.com/SUBA/tip0300/rh0398.htm Note, you may have to relogin / restart to make the changes take effect. Kirk Before: <--------snip----------> Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation] "Bias"=dword:00000168 "StandardName"="Central Standard Time" "StandardBias"=dword:00000000 "StandardStart"=hex:00,00,0a,00,05,00,02,00,00,00,00,00,00,00,00,00 "DaylightName"="Central Daylight Time" "DaylightBias"=dword:ffffffc4 "DaylightStart"=hex:00,00,04,00,01,00,02,00,00,00,00,00,00,00,00,00 "ActiveTimeBias"=dword:0000012c <--------snip----------> After <--------snip----------> Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation] "Bias"=dword:00000168 "StandardName"="Central Standard Time" "StandardBias"=dword:00000000 "StandardStart"=hex:00,00,0a,00,05,00,02,00,00,00,00,00,00,00,00,00 "DaylightName"="Central Standard Time" "DaylightBias"=dword:00000000 "DaylightStart"=hex:00,00,0a,00,05,00,02,00,00,00,00,00,00,00,00,00 "ActiveTimeBias"=dword:00000168 "DisableAutoDaylightTimeSet"=dword:00000001 <--------snip----------> Kirk Peter Rodger wrote:
Hi, allDue to security concern, we enforce that users can not change system time. But somehow lots of users do not check the daylight savings box. Is there a way that we can check daylight savings boxthrough group policy or script? Thanks, Peter __________________________________________________ _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com
-- ___________________________________________________ Kirk Schafer Infosec Capital - Your Information Security Asset 308 East Broadway Ave, PO Box 1851 Fairfield, IA 52556 641-919-1783 (mobile) http://www.infosec-capital.com
Current thread:
- Group policy help Peter Rodger (Oct 15)
- Re: Group policy help Kirk Schafer (Oct 18)
- Re: Group policy help Peter Rodger (Oct 20)
- Re: Group policy help stilist (Oct 21)
- Re: Group policy help Peter Rodger (Oct 20)
- Re: Group policy help Greg (Oct 18)
- Re: Group policy help Kirk Schafer (Oct 20)
- <Possible follow-ups>
- RE: Group policy help adisegna (Oct 15)
- RE: Group policy help adisegna (Oct 20)
- Re: Group policy help Kirk Schafer (Oct 18)