Programmatically setting SYSTEMTIME in Windows 8/10 - an exercise in madness!

"They say time is the fire in which we burn"

It started out as a simple request... add a page to a custom embedded WPF application that will allow the user to set the date/time directly from the application. Seemed simple enough. I created the following screen (only a portion of the screen is shown below):

Now, for better or worse, I do a large majority of my development on Windows 7 machines even if the target is a Windows 8/10 machine where the application will be deployed. In general, what works on Windows 7 usually works on Windows 8/10, or so you would think.

This works on Windows 7, but as you would expect, it fails on Windows 8/10. We get back the dreaded E_NOACCESS. Even running as Admin under the BUILTIN\Administrators group with UAC off, we still get the same thing.

Time to do some Google searching. A quick search reveals posts on StackOverflow and MSDN that our user requires privileges to change the system time. That actually makes sense, since there are applications that depends on file timestamps to make decisions and such.

OK, lets enable the required privilege for our Admin user. On Windows 7. thats relatively straight foward - its just a matter of flipping a switch. On Windows 8/10, however, that privilege needs to be added to the user's token. Lets go ahead and add some code to add a privilege to our Admin user and then enable the privilege:

So to summarize, the code should look as follows:

Fire up the debugger, set the time, and... it doesnt work! WTF?!?

"You raise the blade, you make the change,
you rearrange me till I'm sane"
-Roger Waters
Dark Side of the Moon

So what gives? I spent hours searching Google, but could not find the answer...

Turns out there is one more step that is needed in order to make this work. You see, under Windows 8/10, in addition to UAC (User Access Control), there is also the motion of 'Admin Approval Mode'.

Yes, that's right kids, here is the story:

Under Windows there are two different flavors of security, one governed by Local Security Policy and one by Group Policy. In the situation I found myself in, I was stymied by Local Security Policy.
Note: Group Policy is typically govered on a domain based level.

In order to be able to make the changes I needed, I had to disable the Admin Approval Mode.

Here are the steps to do this:

On the Windows 8 desktop, press the Windows + R key to launch the Run dialog box:

Type secpol.msc into the Open edit box.
Click OK.
The Local Security Policy applet will launch and display:

Highlight the Security Options under Local Policies on the left hand panel.
Double click the user Account Control: Run all administrators in Admin Approval Mode on the right hand panel.
The Properties dialog will display:

Click Disabled and click OK.
You will be prompted to reboot the Display Unit for the changes to take affect.
Go ahead and reboot:

And there you have it.

Happy trails.

Note: Sample source can be found in my .git repository here:
Sample Source: