# Ensure 'Change the time zone' is set to 'Administrators, LOCAL SERVICE, Users'

Necessity: The 'Change the time zone' privilege (SeTimeZonePrivilege) controls which users can alter the system's time zone. Accurate system time is critical for security, as event logs, file timestamps, and network authentication protocols like Kerberos depend on it. If an unauthorized user or malicious process changes the time zone, it can obscure the timeline of a security incident, disrupt time-sensitive applications, and facilitate log tampering, thereby severely hindering forensic investigations and incident response. Restricting this privilege ensures the integrity and reliability of system time.

Auditing and Remediation: The audit script inspects the local security policy to identify which accounts and groups are currently granted the 'SeTimeZonePrivilege'. The remediation script modifies the security policy by creating and applying a security template that sets the privilege to a specified list of principals, enforcing the desired configuration.

Recommended State Rationale:
- Basic: ['Administrators,LOCAL SERVICE,Users'] - This is the default Windows configuration, offering convenience for standard users who might need to adjust the time zone for legitimate reasons, such as travel. It balances usability with basic security.
- Moderate: ['Administrators,LOCAL SERVICE'] - This state enhances security by removing the privilege from the general 'Users' group, adhering to the principle of least privilege. Standard users typically do not have a business need to change the system-wide time zone. This restriction reduces the risk of accidental or malicious changes by non-administrative accounts.
- Strict: ['Administrators'] - This is the most secure configuration. It limits the ability to change the time zone exclusively to system administrators. This is recommended for high-security environments, servers, and critical systems where time integrity is paramount and any change must be a deliberate, privileged, and audited action.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators,LOCAL SERVICE,Users']` |
| **Moderate** | `['Administrators,LOCAL SERVICE']` |
| **Strict** | `['Administrators']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the 'SeTimeZonePrivilege' (Change the time zone) user right from the local security policy. The script must parse the security policy export to return only the comma-separated list of assigned principals (e.g., '*S-1-5-32-544,*S-1-5-19'), with no headers or extra text.

## Remediation Script Working

PowerShell script that configures the 'SeTimeZonePrivilege' (Change the time zone) user right. The script must accept a single command-line argument: a string containing the comma-separated list of principals (e.g., '*S-1-5-32-544,*S-1-5-19'). The script should apply this setting using the local security policy database and must output '$true' on successful application or '$false' if it fails.

