Disable task manager from a limited / guest account

Question

I am developing an application in c++ from which a user can disable task manager from within the application (and little more functions). Here's how i did it in visual c++ :

HKEY regHandle;

DWORD dwValue = 1;
BYTE* data = (BYTE*)&dwValue;

RegCreateKeyEx(HKEY_CURRENT_USER,"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 0, NULL, NULL, KEY_WRITE | KEY_WOW64_32KEY,NULL , &regHandle ,NULL );
RegSetValueEx(regHandle,"DisableTaskmgr",0, REG_DWORD,data ,sizeof(DWORD));

It worked well in administrator account. But in limited user account and guest account, it doesn't work. It tried to change UAC level to administrative privileges / Highest available. Both didn't work. I also checked whether i can do it via writing the reg value to HKEY_LOCAL_MACHINE. Sadly, that too failed.

I've googled well, and searched stackoverflow, but didn't find a solution. Manually editing group policy / registry is not at all a solution, i've to do it from inside my application as and when needed. Thanks in advance for your help.

Being able do edit the registerly when you don't have the rights to do so would be quite a security flaw, don't you think? In other words, you are asking "How do I bypass the security in Windows", and expecting people to tell you (in case anyone does know...). — Mats Petersson, Aug 03 '13 at 22:02
I'd add a "Deny execute" (or just "deny all") record for that user account to the TaskMan executable's DACL. — Jerry Coffin, Aug 03 '13 at 22:22
@MatsPetersson , i dont think it is a security flaw. It is common that few application needs to disable taskmanager. Why not it be done if the application is running with admin privilege from limited account. Is that why windows has UAC? — Jasir, Sep 07 '13 at 10:58
@Jaz: Being able to edit registry keys that you don't have the right to would definitely be a security flaw. Being able to disallow task manager from an account that has the correct access rights not so. But your original question is about "How do I bypass the security settings on registry?", which I sure hope there isn't any way to do in Windows, as it would have quite serious security consequences. — Mats Petersson, Sep 07 '13 at 11:05
@MatsPetersson: I think you didn't get my question. Sorry if i was not clear. My app needs admin privilege to run. If i need to run the app in a limited account, i should type the admin password in UAC popup. So it is running with the permission of admin and didn't bypass UAC. Even then i'm not able to disable task manager! — Jasir, Sep 28 '13 at 06:30

score 2 · Answer 1 · answered Jan 01 '14 at 18:44

I assume it is because you are modifying a group policy option through the registry:

enter image description here

But the group policy hasn't taken effect yet. Microsoft says you have to reboot.

Perhaps forcing a group policy update

gpupdate /force

will cause it to take effect.

This is the kind of thing that your installer would do, then remind the user that they must restart the computer before the installation is complete. Or maybe, since it's just HKCurrentUser, a logoff and login will work.

Disable task manager from a limited / guest account

1 Answers1