windowsprivileges

Permissions missing to use SetSystemTime


I'm trying to use SetSystemTime (from Kernel32.dll) or alternatively to use TIME from cmd.exe.
Both fail, TIME gives me the error

A required privilege is not held by the client.

I've already used gpedit.msc to add local/Users and also the user itself to security settings/Local Policies/Change the system time.
I tried to enable the privileg with AdjustTokenPrivileges( SeSystemtimePrivilege ...), but I got a GrandPrivilege failed error .

I'm using Win7 x32 Professional.

It's a standard user with admin privileges, but I'm trying to make the time changes without "Run as Administrator", as the program that calls the SetSystemTime function shouldn't be started with "Run as Administrator".

I supposed that the purpose of the Change the system time policy is exactly for this case and it's also described at MSDN

I'm at a loss what to do.


Solution

  • It turns out that although SeSystemTimePrivilege doesn't trigger UAC for a non-administrator, it is still removed from the restricted token that is generated when an administrator logs in. The upshot is that you can use group policy to assign SeSystemTimePrivilege to non-administrative users, but the policy has no effect for an administrative user.

    If it is acceptable for the program to require elevation when run by an administrative user, you could use the highestAvailable manifest setting. That way, the program will only ask for elevation if the user is an administrator. Alternatively, you could design the program to ask for elevation only when it actually needs to set the time.

    If an elevation prompt is not acceptable, you will have to install a system service to change the system time on your application's behalf.