here is another way to do what you want.

I believe all that's required is to grant the "Change system time" right to everyone in User Manager for Domains. Pick the domain that the computers are members of. That is, if you have an account domain and one or more resource domains, focus User Manager for Domains (not UM for the local machine) on the resource domain(s). User rights are domain wide so you don't have to do this on each client box.