[2005] Disabling users from ending my application

[kadem]

I've written an application to control user usage of a computer based on time, that was easy but, how can I protect my application so that user can't use the task manager to end it?
Note that I still want the user to access the task manager.

[gigemboy]

I dont know if you can, unless maybe running the app under an admin user or something and see if a regular user that doesnt have permissions are allowed to close it.

Controlling access by time can be done through the regular windows admin functions and user policy, though, and should actually be done instead... its what user and group policies are for...

[Grunt]

well, your getting into a grey area here by doing this, but you can disable the task manager through the registry. I have done it before, but not sure which key it is.

[RobDog888]

Using a GPO would probably be your best bet since you still need to allow access to the TM.

[kregg]

Disable the task manager and make your own task manager

[RobDog888]

Better still, in 2005 you have the FormClosing event of a form with a closing e argument that you can determine the reason why its closing.

Check for the TaskManagerClosing as the e.CloseReason value and cancel the action.

Private Sub Form1_FormClosing(sender as Object, e as FormClosingEventArgs) Handles Form1.FormClosing
    If e.CloseReason = TaskManagerClosing Then
        e.Cancel = True
    End If
End Sub

Note, using this technique can lead to trouble closing your app if there is an error or some undesired behavior where the form either doesnt have or isnt working to close the form and you really do need to close it. In such a case your app will not be closable and you would have to reboot or logoff.

[Negative0]

If you use RobDog's method, instead of just canceling the close, maybe you prompt for a password. If the correct password is given, you close it, if not, it stays open.

[RobDog888]

Good suggestion, I like it!

I was worried about not being able to close the app yourself when you really need to like non-responses and program hangs etc.

[TTn]

Here is an example on how to catch the ctrl alt delete combo, and react to the task manager.

DisableTaskMgr

EDIT: But you want to still be able to use the task manager.
What level of access to the task manager is acceptable?
For example you can disable the right click that allows the user to Terminate the process. And disable the end process button ofcourse.

[RobDog888]

Referring to the right click: they can also select the process and click on the "End Process" button.

[TTn]

It looks funny now, because I appended my post, just as you were posting. Hehe.

This is a specific question, which needs more than protection against the closing event. I'm sure there are a few other details, that need to be protected.

[kadem]

If you use RobDog's method, instead of just canceling the close, maybe you prompt for a password. If the correct password is given, you close it, if not, it stays open.

Thank you guys, it seemed to be the best solution for this.

[kadem]

I've just tried closing the application with RobDog code using the Task Manager; it works fine the first time you end it, but if the user keep ending the task it will eventually get ended!

[RobDog888]

How do you mean? Like rapid clicking or something?

[kadem]

By clicking the End Process several time the application will get stuck and the End Program dialog box will pop up then just by clicking the End Now button will terminate my application.

[circuits2]

This is why you need to use GPO. Windows 2k and after are designed to separate the OS from 3rd party software to prevent situations like the one you are trying to intentionally create. Use RobDog's method, but also use a GPO. The GPO will catch nearly everything, RobDog's will be the failsafe.

[TTn]

For parental control purposes only please.

Hide a process

[Half]

taskkill /f /im whatever.exe 

from the cmd will still kill the whatever app. Even if you delete it, it can be downloaded again. If it is not XP, there are enough vbs snippets out there offering the same functionality. One is even from MS itself.

CMD can be opened from the task manager (you said you still need it). Even if you somehow disable the Run there, any executable can be started form mIRC for example. And mIRC can be installed even on a guest account

[TTn]

taskkill /f /im whatever.exe
from the cmd will still kill the whatever app.

True, providing that they know the name of the executable file.
In my example, you can't see the executable process in the task manager.

taskkill /f /im WhatsMyName.exe

Is fairly inoperable.

[Half]

Come on man, anyone knowing about taskkill would at least know about HijackThis as well - able to show/export as text the running processes among other things

[TTn]

Come on man, anyone knowing about taskkill would at least know about HijackThis as well - able to show/export as text the running processes among other things

That's the point,... along with RobDogg's suggestion, this works in most situations, so that most "end users" are unaware.

[Half]

That is true of course, kadem should simply know what to expect and not just implement partial security. Personally I'd go with more than one services that monitor the app and restart it if needed. I had a pretty bitter experience with some trojan swarm and they were using the same tactic, restarting (in my case redownloading) each other as soon as one gets deleted/stopped by the user.

[TTn]

I agree, with extra protection here.
It's ironic to come full circle, and find that levels of security, can be learned from a malware, or a trojan etc!