Install an application that even an admin user cannot uninstall?

[eselk2003]

I'm working on a new application that a parent may want to install,
and that they would not want their kids to be able to uninstall. I
can't go in to many more details than that.

Unfortunately there is still a HUGE amount of software out there that
will not work correctly if we force the user to make their kids run
under a non-admin account, in XP or Vista, so we don't want to require
them to do this. However, if the child is running as an admin, is
there really any way we could stop them from uninstalling/disabling
our application? An admin has full access to everything on the PC,
right?

I know we could make it pretty dificult, by doing things that are
typical of viruses or spyware programs, like injecting our code in to
system process, or replacing system DLLs, etc... but what I'm looking
for is a documented and recommended method for one admin user to be
able to install something and then prohibit any other user (even
admins) from removing it. I'm not writing spyware, really.

I suppose what I'm looking for may be some type of custom permissions
provider, that for example would not allow an admin user to adjust
permissions on certain objects (files and registry settings) or
terminate certain processes.

I'm a programmer, but I'm asking this question here because I'd also
like to know about any non-programming options.

 

[Leonard Grey]

"An admin has full access to everything on the PC, right?"

Correct.

 

[Shenan Stanley]

I'm working on a new application that a parent may want to install,
and that they would not want their kids to be able to uninstall. I
can't go in to many more details than that.

Unfortunately there is still a HUGE amount of software out there
that will not work correctly if we force the user to make their
kids run under a non-admin account, in XP or Vista, so we don't
want to require them to do this. However, if the child is running
as an admin, is there really any way we could stop them from
uninstalling/disabling our application? An admin has full access
to everything on the PC, right?

I know we could make it pretty dificult, by doing things that are
typical of viruses or spyware programs, like injecting our code in
to system process, or replacing system DLLs, etc... but what I'm
looking for is a documented and recommended method for one admin
user to be able to install something and then prohibit any other
user (even admins) from removing it. I'm not writing spyware,
really.

I suppose what I'm looking for may be some type of custom
permissions provider, that for example would not allow an admin
user to adjust permissions on certain objects (files and registry
settings) or terminate certain processes.

I'm a programmer, but I'm asking this question here because I'd also
like to know about any non-programming options.

Actually - I would venture to put out there that software that *will not
run* as anything but an administrator or a power user in a Windows based
environment is badly written. There is *not* a huge amount of software like
this - in my experience. Actually - thanks to wiser programmers taking into
account security and stability of a system - I would say there is few and
far between of this sort of software left.



In any OS - your safest method of usage is through an account that does not
have advanced privileges. If the application requires such privileges to do
its job (not talking about specialized utilities or speaking of 'to install
properly') - then I believe the application's creators made a mistake in
causing the application work in that manner.



In this case - especially - the children should *not* be given
administrative or power user rights.

 

[eselk2003]

Actually - I would venture to put out there that software that *will not
run* as anything but an administrator or a power user in a Windows based
environment is badly written.  There is *not* a huge amount of softwarelike
this - in my experience.  Actually - thanks to wiser programmers takinginto
account security and stability of a system - I would say there is few and
far between of this sort of software left.

While I agree that modern software probably will have less and less
issues, and possibly most software made prior to XP will not have any
issues... the problem is, in my experience, a lot of people are still
running older software, probably even software from the mid to late
90s. There are a lot of places you can buy used software, so
obviously people are still using it. I know most kids probably don't
use this program, but one in particular that broke on my system when I
switched to a non-admin account was Microsoft Money 2000. Microsoft
states they know it doesn't work, and that you should upgrade.
Problem is, I don't want people to have to choose between keeping my
software, or keeping their old software (if they aren't willing to
upgrade, or in some cases can't because it is no longer supported/
updated).

That said, chances are we are going to require the kids to be non-
admin users... since I haven't found any better options (just wanted
to make it clear why I would at least want to look for other options,
since the option of making them non-admins, like Microsoft recommends,
isn't really that clear-cut or simple).

Only other option I found is to be like anti-virus software, and have
a "self-defense" mechanism built in. But that is a real mess, which
requires device drivers for kernel-level API hooks to make sure that
even admin users can't terminate your process or edit your registry
settings, delete your files, etc. This is what Avast anti-virus does,
as well as others. Even then, of course they can get around it, but
at least it requires a lot of work, like booting from the Windows CD
or in to safe mode.