Allow all the standard windows 10 users to change/sync time and date settings

Question

Hi,

I'm looking for a way to push an organization wide policy which lets Standard users to change/sync their date and time settings. All these devices are Intune managed. Currently all the users have their "Sync time" button greyed out and needs admin credentials to sync time.

I have enabled Location to all users under https://endpoint.microsoft.com -> Devices -> Config Policy -> Device restrictions -> Privacy -> Enable location.

Any help is much appreciated.

Answer 1

First, sign in with an administrative account and open the Group Policy Editor by hitting Start, typing “gpedit.msc”, and then pressing Enter. In the Group Policy window, in the left-hand pane, drill down to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignments. On the right, find the “Change the system time” item and double-click it.

On the “Local Security Setting” tab of the properties window that pops up, note that by default, only the Administrators and LOCAL SERVICE groups are currently listed as having permission. Click “Add User or Group.”

By default, Windows does not include group names when you perform a search, so you’ll need to enable that first. Click the “Object Types” button.

In the Object Types window, select the Groups check box to enable it and then click OK.

In the “Enter the object names to select” box, type “Users” and then click the “Check Names” button. Windows will check against usable names and then fill out the box with the full name of the group (<yourPCname>\Users). When that’s done, click OK.

Back in the properties window for the system time setting, you can see that the Users group has now been added to the permissions list. Click OK to apply the settings and return to the Group Policy Editor.

And that’s all there is to it. You can now exit the Group Policy Editor. To test the new settings, just sign in with a standard user account and try changing the time or date. And if you change your mind and want to prevent standard users from changing the time and date, just use Group Policy Editor to return to that setting and remove the Users group from the permissions list.

Answer 2

Note that there is no direct way to configure the setting noted above by @Vicky Wang in Intune and that device restriction policies are completely unrelated. You can however deploy a script using Intune that changes this privilege or use a custom profile that leverages the UserRights settings in the Policy CSP: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-userrights.

Keep in mind though that a system's time is used during many critical security processes so this may not be the best idea.

Why do users need to manually sync or change the time on their systems? Time sync is an automatic process in Windows that requires no user intervention. See https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/how-the-windows-time-service-works for details.

Answer 3

Hi,

Just checking in to see if the information provided was helpful.

Please let us know if you would like further assistance.

Best Regards,
Vicky

Answer 4

Hi,

Just checking in to see if the information provided was helpful.

Please let us know if you would like further assistance.

Best Regards,
Vicky

Answer 5

I guess this is exactly what I was looking for
https://learn.microsoft.com/en-us/answers/questions/18841/standard-users-cannot-sync-clock-after-windows-aut.html