How to prevent user changing system date/time (in Windows 7)?

Question

Having googled, the general advice is to create a standard, non-administrator account.

I just tried that. I only had one account, my own, which is an administrator and then created a second (not the Guest account). I logged out of my own account and into the new one and tried to change the time. Windows 7 popped up a box asking if my main account would allow this (and prompting for its password).

I have been told "it shall not be possible to change system date/time". I intended to deliver a PC with only a standard account and my s/w, but can't (I think) prevent the user from creating an administrative account and changing date/time.

Can I prevent this programatially from Delphi, or do I just have to say that if the user wants to be destructive I can't prevent it?

Solution 1

In your application, you can actually detect user changing system time while your application is running.

You will receive WM_TIMECHANGE when system time change.

When startup, you can saved the gettickcount (As StartTickCount) and now (As StartTime). When checking, you can check if the different between tickcount and the different between time match (allow a small discrepancy) and know the different. However, if the user change system time away from your application, this trick do not work. Maybe you can have a service which is auto start checking for this.

If you need to change back to original time, here is some resources : CHANGE the system TIME

btw, in OS level, a normal user cannot create an admin user.

Solution 2

Generally this kind of restrictions are set using the Windows Group Policy

From delphi you can use the Group Policy API or the RSoP WMI Classes.

Comments

[RRUZ]

If you distribute the PC with an standard account and you hold the password of the Administrator user, there is not way which the user use their own restricted account to create a new Adinistrative account.

[Cosmin Prund]

@RRUZ, what's stopping the user from shutting down the PC and changing the date and time in the BIOS? While you can't "recover" the Windows Administrator's password, you can easily work around a BIOS password.

[David Heffernan]

What if the time on the computer is wrong? Shouldn't the user be able to change it?

[Mawg says reinstate Monica]

+1 I was thinking of storing time & checking for change. I could auto-start my app (it ought to be the only app running, but .. you know users ... :-/

[Mawg says reinstate Monica]

+1 but I can't figure how to get to the Windows Group Policy editor in Windows 7... Control panel/ administrative tools? Then what?

[Mawg says reinstate Monica]

Aha! Windwos home premium probably doesn't have such a thing. Even running polsec.msc on another machine works

[Justmade]

@Mawg yeah, for attendant, my program normal call to log in server which use server time, but user will unplug / exit program / change time or so. So I keep several tracking trick (latest log time > current log time? / last exit program time > current program start time / cable plugged?, etc) and log the possibly cheating info for the system admin to consider.