Skip to main content
Question

Allow non admin users to change date and time on Ventura/Sonoma

  • Mar 18, 2024 9:34 AM UTC
  • 5 replies
  • 141 views

Forum|alt.badge.img+3

Hi all,

 

We are pushing a script to allow users to change date and time as below:

##Allow User to Change Time

security authorizationdb write system.preferences allow
security authorizationdb write system.preferences.dateandtime.changetimezone allow
security authorizationdb write system.preferences.datetime authenticate-session-owner-or-admin

 

This was working fine until now, but it stopped. Did apple changed the preference settings?

 

5 replies

danlaw777
Forum|alt.badge.img+17
  • Valued Contributor
  • Mar 18, 2024 11:56 AM UTC

you would think that their time would just be correct...we're having this issue too


AJPinto
Forum|alt.badge.img+26
  • Legendary Contributor
  • Mar 18, 2024 12:32 PM UTC

With how things have been changing with NIST, I could see apple blocking this. One of the NIST guidelines is to ensure time is set securely for SIEM logging. Allowing users to change time at their own discretion breaks timelines on event logging.


Bol
Forum|alt.badge.img+11
  • Contributor
  • Mar 18, 2024 2:34 PM UTC

lol gold. I've just confirmed this works on 14.4, specifically this line;
security authorizationdb write system.preferences.datetime allow

I couldn't find a key that exists (anymore?) for: system.preferences.dateandtime.changetimezone
Good reference https://www.dssw.co.uk/reference/authorization-rights/system-preferences-datetime

Your last command uses a rule that requires auth of either standard or admin user eg. authenticate-session-owner-or-admin which contradicts the previous allow line? i think.

Anyway, see if this works the way you intended, all ok in my environment with the example lines below;
security authorizationdb write system.preferences allow
security authorizationdb write system.preferences.datetime allow
security authorizationdb write system.preferences.printing allow


Forum|alt.badge.img+3
  • Author
  • New Contributor
  • Mar 18, 2024 2:35 PM UTC

i think it may be the CIS Level 1 blocking this 


Bol
Forum|alt.badge.img+11
  • Contributor
  • Mar 18, 2024 10:00 PM UTC

This didn’t work!?

security authorizationdb write system.preferences allow 
security authorizationdb write system.preferences.datetime allow
security authorizationdb write system.preferences.dateandtime.changetimezone allow
security authorizationdb write system.preferences.datetime authenticate-session-owner-or-admin
security authorizationdb write system.settings.datetime allow