Can't set clock using SetSystemTime on Windows 8

Question

My app uses SetSystemTime() to set the PC clock from a GPS source. This works fine in Windows 7 with User Account Control disabled, but in Windows 8, even with UAC disabled, it fails. The error I get back is ERROR_PRIVILEGE_NOT_HELD. The user logged into the machine is in the Administrators group. I can only get it to work if I run the application as "Run as Administrator" from the file's context menu in Explorer - but the logged-in user IS an Administrator.

So... what do I need to do differently on Windows 8 to get SetSysytemTime() to work? Do I need even more elevated privileges than the current users' Administrator rights? If so, what has higher privileges than Administrator? Or do I need to set the user account up differently to allow these kinds of calls to work on Windows 8?

EDIT: As noted in the comments, manually attempting to enable the SE_SYSTEMTIME_NAME privilege doesn't work. Neither does trying to add the privilege using the suggested MSDN method of LsaAddAccountRights.

Answer 1

I think it might be related to the fact that, with UAC disabled on Windows 8, processes (by default) run at Medium Integrity, not High Integrity (see this post).

I think you need to request requireAdministrator in your application manifest

Answer 2

If you move the UAC slider down completely in "User Account Control Settings", it means that UAC won't show any prompts, but is still enabled. Any normal process still runs without administrative privileges, but elevating (by "run as administrator" or by having declared "requireAdministrator") will happen without user consent.

Disabling the Security Policy "User Account Control: Run all administrators in Admin Approval Mode" or setting the registry key "EnableLUA" to 0 will change this behaviour, but prevent all Metro Modern UI apps from running.

If your users don't have administrative rights, you can't change the system clock without using a service.

If you want your application to start normally (but without special rights) for normal users and (auto-)elevate for administrators, you may want to declare "highestAvailable" in your manifest.