C# SetSystemTime (WIN API) hooking

Question

Hello. I need restriction for time changes coming from different sources. The best way, as i think, is to hook WINAPI function SetSystemTime (and maybe SetLocalTime). I tried to hook this by using EasyHook library with injection in all running processes, owned by current system user. But it had no effect. How can I do that?

Answer 1

Any reason you cannot just P/Invoke SetSystemTime as shown here?

Note that you need an elevated privilege to do this:

An application must have system-time privilege (the SE_SYSTEMTIME_NAME privilege) for this function to succeed.

Answer 2

The problem was on my own system. I use Windows 7 and when i changing time via standard clock setting dialog rundll.exe process runs and it starts dllhost.exe process which calls SetLocalTime. I have tested it on another 2 PCs (WinXP & Win7) but there rundll.exe calls SetLocalTime itself.