Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to prevent a Windows Vista client who is a local administrator of her own machine to remove a installed program? The program should not be removed by clients either from normal mode or safe mode.

share|improve this question
This is a management issue and should be dealt with accordingly. – Jacob Feb 24 '12 at 2:23
up vote 1 down vote accepted

As others have said it's a management issue but there is a way to reinstall an application if you have a client on the domain and deploy the software via group policy.

Do you have a group policy that deploys the software? While it won't redeploy automatically if someone removes the software you can use the procedure documented at to force it to reinstall.

If you can remotely access the computer's registry you could remove the GUID of the application and then group policy would take care of it.

share|improve this answer

No. If they are a local administrator, they have full privileges over their machine, you can't prevent them from doing anything.

share|improve this answer
+1 They're an admin, for a reason, this allows them to do anything they want. – jscott Feb 24 '12 at 2:30
+1 - Yep. It's a management issue, not a technical issue. – Evan Anderson Feb 24 '12 at 2:37
Even if they don't have local administrator rights they can probably remove it if they are determined enough and have physical access. – Zoredache Feb 25 '12 at 1:42

This is not entirely true, it really depends on how much work you want to do and how savy you think they are. Look at the idea posted here: I'd be willing to bet that would work just fine

share|improve this answer
Did you actually read your link? What does that prevent an admin from doing? – jscott Feb 24 '12 at 3:57
So first, just becasue you're an admin, doesn't mean you can't be locked out / restricted from doing stuff. To answer your question more specifically, if he were to do two things: modify the registry permissions for that app, and take it a second step further by modifying the NTFS permissions he could make it very difficult for that staff member to remove the app. Notice i didn't say impossiable, nor did i dispute that this is a managment issue. – Eric C. Singer Feb 24 '12 at 13:28
"Make it very difficult"? No, I disagree. Reverting the changes, as an admin, would be as trivial as applying them. The OP's question asks "How to prevent...", not "How to make more steps in order to...". FWIW, I've not downvoted you, although I think your post is more a comment than an answer. – jscott Feb 24 '12 at 13:47
Secondly we removed the security tab, thus forcing them to dig into the command line. So we're starting to get to a point where you'd really need to know what you're doing to change anything. My point with all this is, you can put measures into make it more difficult, but I'm not disputing that it's not possiable to circumvent. The question is, can the averge user circumevent a solution such as this, and i remain steadfast that its likely they cannot. – Eric C. Singer Feb 24 '12 at 14:28
No worries here, no offense taken. The additional information from your comments would make nice inclusions for your answer. The extra changes you've described provide a lot more detail than a single link to a PCMag forum post. I think you could build a stronger answer using your knowledge/config info. – jscott Feb 24 '12 at 15:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.