Search code examples
pythonwindowsprivilegeselevated-privileges

SE_SYSTEMTIME_NAME privilege does not exists

I am trying to change the system time from a user account (not from admin account) on windows7 machine. In order to change the system time, it is mentioned in this link that we need to have SE_SYSTEMTIME_NAME privilege. Here is my python script.

import os,sys
import win32api
import win32security

priv_flags = win32security.TOKEN_ADJUST_PRIVILEGES | win32security.TOKEN_QUERY
hToken = win32security.OpenProcessToken (win32api.GetCurrentProcess (), priv_flags)
privilege_id = win32security.LookupPrivilegeValue (None, "SE_SYSTEMTIME_NAME")
win32security.AdjustTokenPrivileges (hToken, 0, [(privilege_id, win32security.SE_PRIVILEGE_ENABLED)])

win32api.SetSystemTime(2015,11,20,20,5,30,0,0)

But when i execute this script i am getting the following error. Here is the traceback.

Traceback (most recent call last):
  File "D:\Public\Script1.py", line 7, in <module>
    privilege_id = win32security.LookupPrivilegeValue (None, "SE_SYSTEMTIME_NAME")
error: (1313, 'LookupPrivilegeValue', 'A specified privilege does not exist.')

Why i couldn't able to acquire the particular privilege. What am i doing wrong?

Solution

  • The string you need is "SeSystemtimePrivilege".

    In Windows header files it's defined like this:

    #DEFINE SE_SYSTEMTIME_NAME TEXT("SeSystemtimePrivilege")

    See here:

    Ideally your Python library would define these strings as named constants. That's the usual pattern used in Python.

    However it still won't work

    I've answered the question but it's still not going to work.

    This is because privileges must be granted to you by an administrator, you can't just turn them on on if you don't have them, that would be a violation of security.

    To grant the privilege, use GPEdit.msc or SecPol.msc. In GPEdit.msc, choose Computer Configuration -> Windows Settings -> Security Settings-> Local Policies -> User Rights Assignment. This is where you find privilege assignments.

    You can either grant the account, or a group the account belongs to, the "Change the System Time" right.

    But that's probably not what you want either.

    if you just want the computer to have the correct time, configure the windows internet time service instead.

    Control Panel -> Date and Time -> Internet Time tab.

    Check the box "Synchronise with an internet time server" If no server is selected choose either "time.windows.com" or "pool.ntp.org".

    This will automatically set the time once per week, which should keep your computer within a few seconds of the correct time. If you are running an important server you may need to set it more often. To do that you need to edit the registry.

    Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\ NtpClient, and check the the value SpecialPollInterval. This is in seconds.

    The default is 604800, which is the number of seconds in a week. For daily time checks, choose 84600. Unless you have very special requirements you won't need more than daily.