Re: Install an application that even an admin user cannot uninstall?

eselk2003@xxxxxxxxx wrote:
I'm working on a new application that a parent may want to install,
and that they would not want their kids to be able to uninstall. I
can't go in to many more details than that.

Unfortunately there is still a HUGE amount of software out there
that will not work correctly if we force the user to make their
kids run under a non-admin account, in XP or Vista, so we don't
want to require them to do this. However, if the child is running
as an admin, is there really any way we could stop them from
uninstalling/disabling our application? An admin has full access
to everything on the PC, right?

I know we could make it pretty dificult, by doing things that are
typical of viruses or spyware programs, like injecting our code in
to system process, or replacing system DLLs, etc... but what I'm
looking for is a documented and recommended method for one admin
user to be able to install something and then prohibit any other
user (even admins) from removing it. I'm not writing spyware,
really.

I suppose what I'm looking for may be some type of custom
permissions provider, that for example would not allow an admin
user to adjust permissions on certain objects (files and registry
settings) or terminate certain processes.

I'm a programmer, but I'm asking this question here because I'd also
like to know about any non-programming options.


Actually - I would venture to put out there that software that *will not
run* as anything but an administrator or a power user in a Windows based
environment is badly written. There is *not* a huge amount of software like
this - in my experience. Actually - thanks to wiser programmers taking into
account security and stability of a system - I would say there is few and
far between of this sort of software left.



In any OS - your safest method of usage is through an account that does not
have advanced privileges. If the application requires such privileges to do
its job (not talking about specialized utilities or speaking of 'to install
properly') - then I believe the application's creators made a mistake in
causing the application work in that manner.



In this case - especially - the children should *not* be given
administrative or power user rights.


--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


.

Relevant Pages

  • Re: family accounts
    ... account to anything less that one with admin rights. ... "I give mom more ... > 5 Kids as limited. ...
    (microsoft.public.windowsxp.newusers)
  • Re: School setup - very limited user accounts.
    ... I am the "network admin" for a school of about 700 kids. ... (all the computers are linked and so ... What we would like to do is setup a very limited user account for each kid. ...
    (microsoft.public.windowsxp.general)
  • Install an application that even an admin user cannot uninstall?
    ... and that they would not want their kids to be able to uninstall. ... An admin has full access to everything on the PC, ... for is a documented and recommended method for one admin user to be ...
    (microsoft.public.windowsxp.security_admin)
  • NAV2005 will not work unless logged in as administrator
    ... admins, but the kids get a "windows installer" popup, and then a NAV2005 ... When I change them to admin type user, ... Had previous version of NAV and probably did not uninstall before ...
    (microsoft.public.windowsxp.help_and_support)
  • Sharing programs with Limited Users
    ... >I have admin rights and have install a few games for the ... >kids play it unless i run it first on my account ... >As i dont like them to be on my Admin account. ...
    (microsoft.public.windowsxp.security_admin)