In a previous post I thought I had arranged the system to force my son off the computer at 11 o’clock. The problem was that he was playing video games and not doing his homework. Being a smart kid he figured out that he could change the time or time zone and continue to play. I vowed to get back to this problem when I had more time. Today was the day I think I finally fixed his wagon. I got lured into researching this problem when I noticed about twenty audit failures with an ID of 537 in the daily log. A little research showed that my son’s PC was causing the problems. The reason was due to a lack of time synchronization between the domain controller and the workstation. He was changing the time and the workstation’s time was wrong. So I did a little more research and found out I could assign the privelege of changing system time(Windows Settings-Security Settings-Local Policies-User Rights Assignment). To make this work I used the Domain Admins group rather than the Adminstrators group. My son was a member of the Administrators group on his local workstation. To reinforce my point to my son, I modified the GPO to force logoff when his logon time expires. There are still several easy ways to get around these restrictions, such as, playing the games on his laptop but this has its risks and downfalls, too. At least once a quarter he has to get his laptop rebuilt since his laptop has gotten completely mucked up. All of the non-school stuff disappears. My hope is that he will decide that trying to get around these boundaries is too much like work.