# Ensure 'Change the system time' is set to 'Administrators, LOCAL SERVICE'

The 'Change the system time' user right determines which users and groups can adjust the time and date on the system's internal clock. The accuracy of the system clock is critical for numerous security and operational functions. Misconfiguration poses a significant risk, as it can disrupt authentication protocols like Kerberos which are time-sensitive, invalidate security certificates, and undermine the integrity of event logs by allowing an attacker to tamper with timestamps to hide their activities. The audit script inspects the local security policy database to retrieve the list of accounts currently assigned the 'SeSystemtimePrivilege'. The remediation script modifies this policy, setting the right to a specified list of principals. The recommended state for all hardening levels is to assign this right exclusively to 'Administrators' and 'LOCAL SERVICE'. Administrators require this privilege for legitimate system maintenance. The 'LOCAL SERVICE' account is essential as it is the security context under which the Windows Time service (w32time) operates to synchronize the system clock automatically. Removing either of these can cause system instability or break critical time-synchronization functions. Therefore, this configuration is considered a standard best practice and is aligned with security benchmarks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators,LOCAL SERVICE']` |
| **Moderate** | `['Administrators,LOCAL SERVICE']` |
| **Strict** | `['Administrators,LOCAL SERVICE']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the Local Security Policy for the 'Change the system time' (SeSystemtimePrivilege) user right. The script must export the policy to a temporary file, parse it to identify the principals (users or groups) assigned this right, and output only the comma-separated list of security principals (e.g., 'Administrators,LOCAL SERVICE'). The output should not contain any labels or extra text.

## Remediation Script Working

PowerShell script that sets the 'Change the system time' (SeSystemtimePrivilege) user right. The script must accept a single, comma-separated string of account names as a direct command-line argument (e.g., '"Administrators,LOCAL SERVICE"'). It should configure the system's local security policy with the provided value and output '$true' on success or '$false' on failure.

