Win - OIB - Device Security - D - Timezone - v3.1 - Change Time Zone doesnt apply

[msellar-inst]

This policy contains a setting which allows an interactive user (*S-1-5-4) to change the time zone.

In my testing (Fresh VM Win11 Pro 24H2, Build 26100.2605, AADj) the setting fails when assigned to either All Users or All Devices with Intune Assignment Error code: 65000 and as expected a std users on the test VM cannot change timezone either via Settings or Control Panel.

On the VM there are various errors in the Event Log: Apps and Services > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics Provider > Admin

_Event ID: 404
MDM ConfigurationManager: Command failure status. Configuration Source ID: (CBDD7CDA-E8DC-41BC-AE01-9880090B7804), Enrollment Name: (MDMDeviceWithAAD), Provider Name: (Policy), Command Type: (Add: from Replace or Add), CSP URI: (./Device/Vendor/MSFT/Policy/Config/UserRights/ChangeTimeZone), Result: (The request is not supported.).

Event ID: 810
MDM PolicyManager: Set policy string, Policy: (ChangeTimeZone), Area: (UserRights), EnrollmentID requesting set: (CBDD7CDA-E8DC-41BC-AE01-9880090B7804), Current User: (Device), String: (*S-1-5-4), Enrollment Type: (0x6), Scope: (0x0), Result:(0x80070032) The request is not supported..

Event ID: 821
MDM PolicyManager: Merge of policy did not complete successfully, Policy: (UserRights), Area: (ChangeTimeZone), Result:(0x80070032) The request is not supported..

Event ID: 806
MDM PolicyManager: Merge string, Area: (UserRights), Policy: (ChangeTimeZone), EnrollmentID requesting merge: (CBDD7CDA-E8DC-41BC-AE01-9880090B7804), Result:(0x80070032) The request is not supported..

Event ID: 4100
UserRights account delete failed. UserRight: SeTimeZonePrivilege, account name: LOCAL SERVICE, SID: S-1-5-19, Name resolution type: Account name mapping mode. Result:(0x80070032) The request is not supported.._

I know there has been some issues with newer Win11 and timezones, I am not sure if its related:
#49

Thanks

[SkipToTheEndpoint]

As I've written in #49, as part of v3.4 I'm going to change the rights to basically enforce the default and configure:
*S-1-5-19 - LOCAL SERVICE
*S-1-5-32-544 - Administrators
*S-1-5-32-545 - Users

I've tested this works on 24H2 with both Dec and Jan CU's, and it should resolve any residual issues with devices that had S-1-5-4 as part of the v3.1 policy.

There's a warning box against the ChangeSystemTime setting:

It feels like something changed when ChangeTimeZone went to release that has the same impact now.