Is there a way to prevent a Windows Vista client who is a local administrator of her own machine to remove a installed program? The program should not be removed by clients either from normal mode or safe mode.
3 Answers
As others have said it's a management issue but there is a way to reinstall an application if you have a client on the domain and deploy the software via group policy.
Do you have a group policy that deploys the software? While it won't redeploy automatically if someone removes the software you can use the procedure documented at http://www.frickelsoft.net/blog/?p=103 to force it to reinstall.
If you can remotely access the computer's registry you could remove the GUID of the application and then group policy would take care of it.
No. If they are a local administrator, they have full privileges over their machine, you can't prevent them from doing anything.
-
2+1 They're an admin, for a reason, this allows them to do anything they want.– jscottFeb 24, 2012 at 2:30
-
1
-
Even if they don't have local administrator rights they can probably remove it if they are determined enough and have physical access. Feb 25, 2012 at 1:42
This is not entirely true, it really depends on how much work you want to do and how savy you think they are. Look at the idea posted here: http://discuss.pcmag.com/forums/thread/106231001.aspx I'd be willing to bet that would work just fine
-
2Did you actually read your link? What does that prevent an admin from doing?– jscottFeb 24, 2012 at 3:57
-
So first, just becasue you're an admin, doesn't mean you can't be locked out / restricted from doing stuff. To answer your question more specifically, if he were to do two things: modify the registry permissions for that app, and take it a second step further by modifying the NTFS permissions he could make it very difficult for that staff member to remove the app. Notice i didn't say impossiable, nor did i dispute that this is a managment issue. Feb 24, 2012 at 13:28
-
1"Make it very difficult"? No, I disagree. Reverting the changes, as an admin, would be as trivial as applying them. The OP's question asks "How to prevent...", not "How to make more steps in order to...". FWIW, I've not downvoted you, although I think your post is more a comment than an answer.– jscottFeb 24, 2012 at 13:47
-
1Secondly we removed the security tab, thus forcing them to dig into the command line. So we're starting to get to a point where you'd really need to know what you're doing to change anything. My point with all this is, you can put measures into make it more difficult, but I'm not disputing that it's not possiable to circumvent. The question is, can the averge user circumevent a solution such as this, and i remain steadfast that its likely they cannot. Feb 24, 2012 at 14:28
-
1No worries here, no offense taken. The additional information from your comments would make nice inclusions for your answer. The extra changes you've described provide a lot more detail than a single link to a PCMag forum post. I think you could build a stronger answer using your knowledge/config info.– jscottFeb 24, 2012 at 15:02