# Ensure 'Change the system time' is set to 'Administrators, LOCAL SERVICE'

Necessity: The ability to change the system time is a sensitive privilege. Accurate system time is crucial for numerous security functions, including Kerberos authentication, which relies on time-stamped tickets to prevent replay attacks. Incorrect time can also invalidate SSL/TLS certificates, disrupt cryptographic operations, and undermine the integrity of event logs, making forensic analysis and intrusion detection extremely difficult. An attacker with this privilege could alter timestamps to conceal their activities or disrupt time-sensitive services. Restricting this right is a fundamental security measure.

Auditing and Remediation: The audit script inspects the local security policy to identify which accounts are currently assigned the 'SeSystemtimePrivilege' user right. The remediation script modifies this policy, revoking the right from unauthorized accounts and ensuring only the specified principals are assigned the privilege.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Administrators, LOCAL SERVICE'. This configuration adheres to the principle of least privilege. 'Administrators' require this right for legitimate system maintenance. The 'LOCAL SERVICE' account is required for the Windows Time service (w32time), which is responsible for automatically synchronizing the system clock with a network time server. Removing this right from LOCAL SERVICE can break time synchronization, leading to clock drift and the security issues mentioned above. Granting this right to any other users or groups is unnecessary and introduces significant security risks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators,LOCAL SERVICE']` |
| **Moderate** | `['Administrators,LOCAL SERVICE']` |
| **Strict** | `['Administrators,LOCAL SERVICE']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the 'Change the system time' (SeSystemtimePrivilege) user right assignment. The script must parse the local security policy to find the accounts granted this right. It should resolve any Security Identifiers (SIDs) to their account names and output a single comma-separated string of these names, such as 'Administrators,LOCAL SERVICE', with no additional text or headers.

## Remediation Script Working

PowerShell script that configures the 'Change the system time' (SeSystemtimePrivilege) user right. The script must accept a single, comma-separated string of account names as a positional command-line argument (e.g., 'Administrators,LOCAL SERVICE'). It should apply this configuration to the local security policy and return $true upon successful application or $false if an error occurs.

