Can't change time or install programs as user with admin rights

[McGraw]

I am a user on our work domain with admin rights.

I have put my user and pc in the administrators group but I still cannot do really simple things like change the system time or install programs.

Really, I'm only bothered about installing programs. How do I give myself access?

XP SP2
Server 2003

Thanks a lot.

[Paul K]

Unless someone has been tampering with the rights/ priviledge settings of the admin group you should already have the access you need. Have you checked what rights the admin group have. Also make sure your name isn't in a group that is denied the rights that you want as a deny over-rides allow settings in other groups IIRC.

[Raistlin]

Originally Posted by Paul

Also make sure your name isn't in a group that is denied the rights that you want as a deny over-rides allow settings in other groups IIRC.

Certainly does: permissions are cumulative, least restrictive applies, except for an explicit deny which will overwrite everything

[Paul K]

Originally Posted by Raistlin

Certainly does: permissions are cumulative, least restrictive applies, except for an explicit deny which will overwrite everything

Exactly One deny in a list and you can kiss goodbye to the right lol. I'd check your permissions list for any group you are in and make sure you aren't denied somewhere. Also check that the domain admin isn't locking those things down.

[Gareth]

Changing the date & time in a domain may have been restricted because the clients are synchronised using the time on the domain controller, which in itself usually gets the correct time from one of 3 sources:

• By synching to a reliable time server on the Internet.
• By synching to an locally-connected hardware time source such as an atomic clock.
• By relying on its own internal CMOS clock for reliable time.

[Raistlin]

It's worth noting that just because you are an "administrator" it doesn't necessarily follow that you have full Admin rights.

We have Admin rights at work for our Business area, but even they are very restrictive with regards to what we can and can't do.

[Gareth]

By the way, synchronising with the PDC is generally a very smart thing to do, as it is often used to prevent attacks on Kerberos authentication. To prevent replay attacks, Kerberos tickets presented to domain controllers by clients are time-stamped. The authenticating domain controller checks to make sure the timestamp is unique and falls within an allowable skew before accepting the ticket and authenticating the client. To ensure this system works properly, both the client and the domain controller clocks must be loosely synchronized within the allowable skew, and W32Time ensures this is the case.