TimeZone change with Powershell

Question

Hallo, I had a ticket open with Microsoft maybe by the wrong channel, they had to close my case and told me to post the problem here.

Thats the summary from Microsoft for the ticket:

• The environment is Windows 10 LTSC 2019, fully patched to build 17763.9121.
• A GPO is configured to prevent users from changing the system time zone.
• The restriction works correctly through the Windows GUI and CMD.
• However, users are still able to change the time zone through PowerShell using Set-TimeZone, without administrator rights.
• The same behavior has been reproduced with both Windows PowerShell 5.1 and PowerShell 7.6.5.
• The Exchange Online troubleshooting previously discussed is not applicable, as the affected devices use generic/shared accounts without mailboxes.

As advised, this behavior needs to be investigated by the Windows Support team. Therefore, please open a support ticket with the Windows team using the information I sent you.

Thank you for your cooperation.

---

Maybe someone here has any idea why it is possible to change the TimeZone with PowerShell without admin rights.

Or what would be also good to know. Can someone reproduce the behavior?

Thank you in advance for any help on this.

Answer 1

Hello Alexn,

Yes, this behavior can be reproduced, and it’s not a misconfiguration on your side. The root cause is that the Set-TimeZone cmdlet in PowerShell does not enforce the same privilege checks as the GUI or tzutil.exe. In Windows 10 LTSC 2019 (build 17763.x), the cmdlet directly writes to the registry under HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation without requiring elevation. That bypasses the GPO restriction which only hooks into the GUI and legacy command-line tools.

This is essentially a gap in enforcement: the Group Policy setting “Prevent users from changing the time zone” (located under Computer Configuration > Administrative Templates > System > Time Zone) only blocks UI and tzutil.exe. It does not extend to PowerShell’s Set-TimeZone. Microsoft has acknowledged this as a product limitation rather than a misconfiguration.

There is no supported registry tweak or GPO extension that closes this loophole. The only reliable mitigation today is to restrict access to PowerShell for non-admin accounts, or to use AppLocker/WDAC policies to block Set-TimeZone specifically. For example, you can create an AppLocker rule under “Script Rules” to deny execution of Microsoft.PowerShell.Management\Set-TimeZone. This way, users can still run PowerShell but won’t be able to invoke that cmdlet.

If you need a more granular approach, WDAC with a deny rule for Set-TimeZone is the cleanest solution. Otherwise, you’ll have to wait for Microsoft to address this in a future cumulative update, as it’s a design oversight in LTSC 2019.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.