如何防止用户卸载应用程序（没有管理员权限）？
我需要禁止没有某些特殊权限的用户卸载应用程序（不是服务！）。如何做到这一点？安装将由域管理员完成，
感谢您的时间
[编辑] 我还需要防止从 Windows 启动中删除应用程序
[编辑1] 澄清：应用程序很简单，安装在其文件夹中并添加到 Windows 启动（实际上是 HKLM\软件\微软\Windows\CurrentVersion\运行注册表）。我真正需要的是禁止为普通用户而不是本地管理员删除此文件夹和此注册表项。
I need to forbid to uninstall an application (not a service!) by a user w/o some special rights. How to do this? installation will be done by domain administrator
thanks for your time
[EDIT] also I need to prevent removing the application from windows startup
[EDIT1] to clarify: application is simple and is installed in its folder and added to windows startup (actually to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry). What I need exactly is to forbid to remove this folder and this registry key, for ordinal users, not for local admins.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
[更新]
文件位置很容易。这很简单，撤销Builtin\Users对该文件夹及其所有子文件夹和文件的写权限，并给予Builtin\Administrators完全权限。您可以通过资源管理器、属性-> 设置此项权限或命令行明智地使用cacls（或icalcs，如果您使用的是win7）
regkey在我的win7盒子上已经只能由用户读取（不可写入），并且由本地管理员读取/写入（regedit - >上下文菜单 - >权限）。
如果它的行为仍然不像您想要的那样找出普通用户所在的组（也是域组），然后检查这些组如何传播到本地计算机。
正如 Ben 在评论中所建议的，您可能会就服务器故障提出一个新问题。
[更新结束]
[编辑回复之前]
我怀疑您是否可以禁止卸载“一个”应用程序。通过组策略，您可以“禁止删除更新”
（在计算机配置/管理模板/Windows 组件/Windows 安装程序下的 GPedit.msc 中）
组策略由域管理员设置，并在整个域中强制执行，因此它不会不需要“权限”。但您当然还需要阻止本地管理员编辑本地组策略。
另一个更令人畏惧的选择是在安全设置的软件限制部分使用组策略。您可以在此处输入不希望运行的 msi 或 exe 文件名称的路径策略。
两者都需要验证/测试，以防止太多的限制阻止每个人开始任何事情......
[updated]
the file location is easy. That is simple revoking write permission on the folder and all its subfolders and files for Builtin\Users, and giving Builtin\Administrators full permmision. You can set this via the Explorer, properties-> permissions or commandline wise with cacls (or icalcs if you're on win7)
The regkey is on my win7 box already only readable (not writeable) by Users and read/write by local admins (regedit -> Context menu -> Persmissions).
If it still doesn't behave like you want figure out what groups a normal user is in (also domain groups) and then check how those groups are propagated to the local machine.
And as sugested by Ben in the comments, you might start a new question on Server Fault.
[end update]
[before edite response]
I doubt you can disallow the uninstall of 'one' application. By means of a Group Policy you can "Pohibit removal of updates"
(in GPedit.msc under Computer Config/Admin templates/windows components/windows installer)
The Group Policy is set by a domain admin and is enforced across the domain so it doesn't require 'persmissions'. But you need off course to also prevent local admins from editing the local group policy.
Another more daunting option would be to use a group policy in the Software Rectriction part of Security Settings. Here you can enter a path policy for the name of the msi or exe file that you do not want to be run.
Both require validating/testing to prevent that to much restriction prevent everybody from starting anything...
如果应用程序需要管理权限才能安装，则非管理员将无权删除它。
如果用户拥有本地管理权限，那么您无法阻止任何事情。
If an application requires administrative rights to be installed, then non-administrators will not have permission to remove it.
If the users have local administrative rights, then you can't prevent anything.