Let’s Locate Systems with Incorrect Time Zone Settings Using SCCM

In this article I explain how you can use System Center Configuration Manager (SCCM) 2007 to find systems configured with an incorrect time zone, and then fix it via an advertisement. The SCCM database stores a system’s time in the same format stored in Windows.

One way to obtain the system’s time zone in Windows is to query for the CurrentTimeZone property of the Win32_ComputerSystem WMI class. The value returned will be number of minutes that the computer time is offset from Coordinated Universal Time (UTC).

For example, New York is 5 hours behind UTC when observing daylight saving. So when New York is in Eastern Daylight Time (EDT), a Windows system in New York will keep the system’s CurrentTimeZone setto ‐240, which represents 4 hours (divide 240 by 60 minutes) and the negative sign representing that it is behind UTC. When daylight savings is in effect, the system’s time will be set an hour behind (for a total of 5 hours behind UTC).

The correct time zone value stored in SCCM for a system in New York while observing daylight saving is ‐‐240. There are built‐in reports in SCCM that show you this time zone value. Sometimes the need may arise to fix the time zone on systems that have it set incorrectly. One way to remediate this is to create a collection that will be populated by systems with an incorrect time zone. In this example, I’ll create a collection that will have as members systems in New York with an incorrect value in the CurrentTimeZone property. If you have systems in multiple time zones, you can first create a collection that contains only computers in New York (you can base your collection on systems’ Organizational Unit in Active Directory or their IP subnet(s), and then when you create the collection with systems having an incorrect time zone in New York you just configure it to be limited to the New York collection.

The SQL query for this collection is

select
SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,
SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,
SMS_R_SYSTEM.Client from SMS_R_System JOIN SMS_G_System_COMPUTER_SYSTEM
on SMS_G_System_COMPUTER_SYSTEM.ResourceID=SMS_R_SYSTEM.ResourceID where
SMS_G_System_COMPUTER_SYSTEM.CurrentTimeZone != '‐240'

Once the collection is populated, you can target it with an SCCM package that will run a program with
the following command to fix it:

Tzutil /s “Eastern Standard Time”

You don’t have to indicate that the package contains source files in Windows 7 as tzutil.exe is built‐in into it.

As systems in the collection successfully run the program, they’ll be removed from it when the collection evaluates next time (the image in this example has the evaluation to be performed once a day). As new systems are reported in the SCCM database with the incorrect time zone value, they’ll become members of the collection when it evaluates next time. Once they join the collection, they’ll receive the advertisement to run the Tzutil fix (as long as the advertisement hasn’t expired).

Share:

Facebook
Twitter
LinkedIn
Picture of Matt Tinney

Matt Tinney

Professional IT executive & business leader having decades of experience with Microsoft technologies delivering modern-day cloud & security solutions.

Contact Us

=
On Key

More Posts

WME Cybersecurity Briefings No. 020
Cyber Security

WME Security Briefing 26 July 2024

Pro-Houthi Group Targets Yemen Aid Organizations with Android Spyware Overview A suspected pro-Houthi group, OilAlpha, is targeting humanitarian organizations in Yemen with advanced Android spyware. The operation is associated with the activity cluster codenamed OilAlpha. It

Read More »
WME Cybersecurity Briefings No. 019
Cyber Security

WME Security Briefing 23 July 2024

Samba File Shares Targeted by DarkGate Malware in Recent Cyber Offensive Overview Recent investigations by Palo Alto Networks uncover a brief but significant cyberattack campaign utilizing DarkGate malware. This malicious software exploited Samba file shares to

Read More »
WME Cybersecurity Briefings No. 018
Cyber Security

WME Security Briefing 15 July 2024

OVHcloud Mitigates Record-Breaking 840 Million PPS DDoS Attack Overview In April 2024, OVHcloud, a top French cloud computing firm, successfully stopped a massive DDoS attack. The attack hit a record-breaking rate of 840 million packets per second

Read More »
E-Commerce Security - Solutions for Online Retailers
Azure

E-commerce Security – Solutions for Online Retailers

Today’s hyper-charged e-commerce landscape demands top-notch cybersecurity measures. Cybersecurity for this bustling sector isn’t just about ticking a technical box; it’s the cornerstone of building trust. As businesses and consumers flock to the online space, the

Read More »
Be assured of everything

Get WME Services

Stay ahead of the competition with our Professional IT offerings.

=