Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Windows treats the system clock and the time zone as two different user rights. To stop standard users from moving the computer’s clock, restrict Change the system time in User Rights Assignment. Decide the Change the time zone right separately: it changes the local-time display and conversion rules, not the underlying clock. Standard users can normally change the time zone, but changing system time requires a full administrator access token under User Account Control (UAC). On a workgroup PC you can set the local policy; on a domain- or MDM-managed device, the effective policy may overwrite that setting.
What is the difference between changing system time and changing the time zone?
The system time is the computer’s absolute clock value. The time zone is the offset and daylight-saving rule Windows applies when it displays that value as local time. Windows exposes them as separate privileges: SeSystemtimePrivilege for the clock and SeTimeZonePrivilege for the display zone. Microsoft documents both privilege definitions in its Privilege Constants reference.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
| Setting | Windows privilege | What changes | Normal standard-user behavior | Main operational concern |
|---|---|---|---|---|
| Change the system time | SeSystemtimePrivilege |
The internal computer clock | Requires a full administrator access token; a standard account cannot elevate itself to obtain this right | Wrong timestamps, authentication failures and policy-processing problems |
| Change the time zone | SeTimeZonePrivilege |
The offset used to display local time | Microsoft’s UAC guidance says standard users can change it unless policy removes the right | Displayed times may no longer match the organization’s preferred zone, but the clock itself is unchanged |
Because the rights are independent, blocking one does not automatically block the other. A user can be prevented from altering the clock while still being allowed to select a different local zone.
Can a standard user change the Windows clock or time zone?
Usually, a standard user can view the clock and change the time zone, but cannot change the local system time. Microsoft explains this distinction in How User Account Control works: changing system time needs an administrator token, while changing the time zone is available to standard users unless an administrator removes that privilege.
Popular on Amazon
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
UAC is not the same as granting the right. If an administrator account approves an elevation prompt, the elevated process can change the clock. If the account is standard and no administrator credentials are supplied, the change is denied. User Rights Assignment determines which accounts or groups may exercise each privilege after sign-in.
How do I block or allow the rights in Local Security Policy or Group Policy?
Use User Rights Assignment, not the ordinary Date and time page, when you need a durable security decision. The policy location is Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. On a standalone computer this is the local security policy; in an Active Directory environment, edit the appropriate computer Group Policy Object (GPO).
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Open the policy editor that governs the computer and browse to the User Rights Assignment node.
- Open Change the system time. Add only the administrator groups, service accounts or other identities that have a documented need to set the clock. Microsoft’s security guidance says to restrict this right to users with a legitimate need; see Change the system time security policy.
- Open Change the time zone as a separate policy. Leave the standard-user assignment in place if travelers or distributed staff must select their current zone; remove it if the organization requires a fixed display zone. The behavior and policy location are described in Microsoft’s Change the time zone security policy.
- Save both assignments. Microsoft states that a restart is not required. The changed assignment takes effect the next time the affected account logs on.
- For a managed computer, check the effective policy rather than assuming the local editor is authoritative. Group Policy precedence runs from local to site, domain and organizational unit (OU); a higher-level GPO can replace the local value at the next policy update.
A setting that is greyed out or cannot be edited locally is a strong indication that a controlling GPO is supplying the value. Make the change in that GPO, or change its scope and precedence, instead of repeatedly editing the local policy.
Should I allow standard users to change the time zone?
Allowing the time-zone right is often reasonable when people move between regions or work across time zones. It changes how Windows renders local times, calendar entries and other user-facing values; it does not move the absolute system clock. Blocking it is appropriate when devices must always present one organizational zone or when local-time changes would confuse operational procedures.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Allow it when users legitimately travel, relocate or need a local display while the device remains synchronized to a central clock.
- Block it when a fixed display zone is part of a support, kiosk or compliance procedure.
- Do not use this setting to protect timestamps. Protect the clock with Change the system time; the time-zone right is a separate control.
Microsoft’s security-policy reference describes little vulnerability from changing the time zone and explicitly notes that system time is unaffected. Your organization’s workflow, rather than a presumed security benefit, should decide this setting.
How should I assign “Change the system time”?
Start with the smallest set of identities that must set the clock. Typical legitimate needs include designated administrators and the accounts used by the organization’s time-synchronization design. Do not grant the right to broad groups merely to make a date-and-time prompt disappear.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep synchronization working
Removing the privilege from interactive users does not mean every non-administrator identity should be removed. Microsoft security-baseline material identifies required service assignments, and a synchronization service may need to retain its right. Test the resulting configuration on a representative device before deploying it widely.
Understand the effect of a wrong clock
Microsoft warns that an incorrect system clock can produce inaccurate event-log, file and database timestamps. On a domain computer, a large discrepancy can also interfere with Kerberos authentication and Group Policy processing. These are reasons to restrict the right, not reasons to change the time-zone policy.
Also popular on Amazon
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
How does the UserRights Policy CSP deploy these settings?
Mobile-device-management administrators can configure the same rights through Microsoft’s UserRights Policy CSP. The CSP reference lists ChangeSystemTime for Windows 10 version 1803 and later. It lists ChangeTimeZone for Windows 11 version 22H2 with KB5053657 and later, and for Windows 11 version 24H2 and later. The listed editions are Pro, Enterprise, Education and IoT Enterprise/IoT Enterprise LTSC. Verify the exact build and edition before selecting this deployment route.
The CSP replaces the existing assignment
A CSP configuration is not an additive “append” operation. Microsoft says it replaces the current users or groups assigned to the configured right. Build the payload from the complete desired assignment, including any accounts the device legitimately requires, rather than sending only the new administrator group.
Always include Local Service
Microsoft requires the Local Service account, SID S-1-5-19, to be specified for both ChangeSystemTime and ChangeTimeZone when using this CSP. The reference reports error 0x80070032 if Local Service is omitted. Preserve that identity and any other required service account in every replacement payload.
What policy wins on a managed computer?
The visible local assignment is not necessarily the effective one. Local policy is processed first, followed by site, domain and OU policy according to Group Policy precedence. A domain or OU GPO can overwrite a local choice during the next policy refresh, so a temporary local test should not be treated as the production configuration.
Also popular on Amazon
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
When a user reports that a right keeps returning, compare the local assignment with the effective computer policy and identify the GPO that supplies it. If the setting is controlled by an MDM policy instead, review the UserRights CSP configuration and its replacement list. Apply the fix at the authoritative management layer, then have the affected account sign in again.
How can I troubleshoot a failed or unexpected change?
| Symptom | Likely cause | Corrective action |
|---|---|---|
| The clock-change control is denied for a standard account | The account lacks SeSystemtimePrivilege, as intended |
Use an approved administrator or service identity, or assign the right to a narrowly scoped group if the user has a documented need. |
| The time zone can still be changed | SeTimeZonePrivilege is separate and remains assigned |
Edit Change the time zone independently; changing the system-time assignment will not affect it. |
| A local edit is greyed out or later reverts | A site, domain or OU GPO has higher precedence | Inspect effective Group Policy and change the authoritative GPO rather than the local policy. |
MDM reports error 0x80070032 |
Local Service (S-1-5-19) was omitted from a CSP replacement assignment | Include Local Service and the complete set of required accounts in both CSP settings. |
| Authentication or policy processing becomes unreliable after a clock change | The system clock is out of synchronization | Restore the approved time-synchronization arrangement and limit interactive access to the system-time right. |
Which policy should I choose for a gaming or shared Windows PC?
Choose based on who needs to change what, not on the wording of the Date and time interface. For a personal machine, an administrator may leave the standard-user time-zone behavior unchanged while keeping clock changes limited to elevation. For a shared, kiosk-like or organization-managed machine, define both rights explicitly and enforce them through the management system that owns the device.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Need accurate logs and authentication: tightly restrict Change the system time and preserve synchronization-service assignments.
- Need users to see their local time while traveling: allow Change the time zone without granting clock control.
- Need one fixed display zone: remove standard-user access to Change the time zone.
- Using MDM: confirm CSP support for the exact Windows build and edition, and include Local Service in the replacement list.
- Using Active Directory: verify the effective site, domain and OU policy so a local test is not silently overwritten.
What should I document before deploying the change?
Record the Windows edition and build, whether Group Policy or MDM is authoritative, the identities that legitimately need each right, and the organization’s time-synchronization method. Test both a standard account and an administrator or service account: confirm that the standard account receives the intended denial or permission, that the time-zone behavior matches policy, and that authentication and policy processing remain normal. Because Microsoft says assignments take effect at the next logon, include sign-out and sign-in in the validation procedure.
Frequently Asked Questions
Will changing the time zone change the timestamps already stored in files or logs?
No. The time-zone privilege changes the offset Windows uses for local display; it does not rewrite the underlying system clock. Applications that render an absolute timestamp in local time can show a different clock reading after the zone changes, so interpret reports with their time-zone context.
Also popular on Amazon
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Can a time-synchronization service still change the clock after I block standard users?
It can, if the service account retains the required user right. Restricting interactive standard users is compatible with keeping the service identity needed to maintain synchronization; remove that identity only after testing the consequences.
Why does my policy work until the next day and then change back?
A higher-precedence site, domain or OU GPO may be reapplied during Group Policy processing. Find the effective policy source and change that object, or adjust its scope, instead of relying on a local assignment.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What does error 0x80070032 mean when deploying the UserRights CSP?
For these CSP settings, Microsoft reports that the error occurs when Local Service (S-1-5-19) is missing. Add Local Service and send the full intended assignment because the CSP replaces, rather than merges with, the existing list.
Do I need to restart Windows after changing either user right?
No restart is required according to Microsoft’s policy guidance. The new assignment applies the next time the affected account logs on, so sign out and back in when validating the result.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
