We launched our network time clock last week. Yes, we’re finally saying goodbye to “punching in.” It was an interesting implementation with very limited documentation, but we’re up and running now. We’ve launched the first phase with our facilities and kids workers.

So, it’s a little hinky. The maintenance staff have to log-in to a computer, open the time clock, click the button, enter their employee number, choose the job code, and click clock in. It’s just a few more steps than remove your card, punch it, replace the card. With the kids workers, we were surprised that it was the first time that one of the ladies had ever used a mouse. Still, the convenience this brings to our financial team is worth the hinky behaviors.

WARNING: GROUP POLICY IGNORANCE AHEAD

We learned that it is possible for employees to change the system time to tweak the amount of hours they worked. Now, it’s not a huge issue in a church, but we don’t want it to be a temptation either. So, today I started playing with Group Policies and the registry editor. I now have the entire domain synced with the us.pool.ntp.org time servers, which is a good thing that needed to happen anyhow. What I can’t figure out how to do is to prevent users with local administrator accounts from changing the system clock. I set the GPO to only allow Administrators to change the time. Still, they can change it. More Google’ing to come.

Related posts

• ACS Responds (0)
• I just dropped a bomb on ACS (0)
• When Fruit Spoils, my edition (0)
• Is it just me Firefox 3? (5)
• Church Survey (1)

1. Christopher Says:
   May 24th, 2007 at 7:18 am

   Why do your users require admin rights? I can see one or two people requiring it, but if you have quite a few people with admin rights, that can be a harmful thing - not only due to their ability to change the time. Most programs that require Admin rights can be “tricked” into thinking they have those rights when they really don’t - you just have to find what file/folder/registry entry they require access to and give them that. If you have someone who installs/uninstalls programs a lot, well that’s a little different, though Microsoft’s way would be to give them two accounts - one with admin rights and one without, and let them use the admin account only when they have to.

   Your way with the time should work though - the next time GP updates it should set the time back correctly. The only issue is if they change the time zone, then they could make themselves hours off, and GP will still see that they have the correct time.