# Ensure 'Change the time zone' is set to 'Administrators, LOCAL SERVICE, Users'

The 'Change the time zone' user right determines which users and groups can modify the system's time zone. This setting is crucial for maintaining accurate system time, which is essential for event logging, forensic analysis, file timestamping, and the proper functioning of time-sensitive network authentication protocols like Kerberos. Unauthorized or incorrect changes can disrupt applications, complicate security incident investigations, and create synchronization issues in a networked environment.

The audit script inspects the local security policy to identify which accounts are currently granted the 'SeTimeZonePrivilege'. The remediation script modifies this policy to enforce a specific list of authorized accounts.

**Recommended State Rationale:**
*   **Basic:** `['Administrators,LOCAL SERVICE,Users']` is the default configuration for Windows client operating systems. It allows standard users to change their time zone, which is convenient for mobile users or those in different regions. 
*   **Moderate:** `['Administrators,LOCAL SERVICE']` enhances security by removing this right from the standard 'Users' group. This follows the principle of least privilege and is recommended for corporate environments to ensure configuration consistency and prevent user-initiated changes that could impact logs and applications.
*   **Strict:** `['Administrators,LOCAL SERVICE']` is the recommended strict configuration. Further restricting this right is generally not advised, as both Administrators (for manual system setup) and LOCAL SERVICE (for automated system functions) require this privilege for legitimate operations. This state effectively hardens the setting by limiting it to administrative and essential system accounts.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators,LOCAL SERVICE,Users']` |
| **Moderate** | `['Administrators,LOCAL SERVICE']` |
| **Strict** | `['Administrators,LOCAL SERVICE']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to audit the 'Change the time zone' user right. The script must query the local security policy for the 'SeTimeZonePrivilege'. It should resolve the Security Identifiers (SIDs) associated with this right into their corresponding account names. The final output must be a single string containing the account names, sorted alphabetically and separated by commas, with no leading or trailing spaces (e.g., 'Administrators,LOCAL SERVICE,Users'). The script must not return any other text, labels, or formatting.

## Remediation Script Working

PowerShell script that accepts a single command-line argument: a comma-separated string of account names (e.g., '"Administrators,LOCAL SERVICE"'). The script must configure the 'Change the time zone' ('SeTimeZonePrivilege') user right with the provided accounts. It should use security policy command-line tools (like secedit) to create and apply a security template with the specified setting. The script must return the boolean value `$true` on success and `$false` on failure.

