Article

rravella's picture
article
Reads:

13574

Score:
3.25
3.3
4
 
Comments:

1

Restricting the ZENworks Workstation Users from Uninstalling or Modifying the ZENworks Configuration Management

(View Disclaimer)

By Ravella Raghunadh

After deploying the ZENworks Adaptive Agent on a workstation, a user having administrator privileges can access and uninstall the product by using the Windows Add or Remove Programs. This Cool Solution helps ZENworks Administrators to restrict the workstation users from uninstalling or modifying the ZENworks software.

Steps

  1. On a managed device, export the ZENworks Folder registry key from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Uninstall\ZENworks to a local file. A sample registry file is shown in Figure 1.

    Figure 1 Sample registry file for a ZCM workstation.


  2. Edit the registry file to add the following line:
    "NoRemove"=dword:00000001


  3. A sample updated file is shown in Figure 2.

    Figure 2 Updated Registry file


  4. Log in to ZENworks Control Center.


  5. Create a new Directive Bundle.

    Please refer to this section of the documentation Novell ZENworks 10 Configuration Management Documentation for help in creating a Directive Bundle creation.


  6. Add Registry Edit Action to the bundle.

    raghu3_0.gif
    Click to enlarge.
    Figure 3 Add Actions window - Registry Edit Action selection

    Get more information on adding the Registry Edit Action.


  7. Browse and import the updated registry file.


  8. Assign the Bundle to ZENworks Configuration Management Devices/Users.
    For more information on assigning Bundle to the devices and users please refer to this page, and this page.


  9. Configure the Bundle Distribution Schedule as “Event” and select “User Login” as trigger.


  10. Select “Install Immediately after Distribution” and “Launch Immediately after Installation” options in Distribution schedule.

    For more details on Bundle Schedules, please refer to this page.

  11. After the bundle is distributed to the managed device, the ZENworks application will not be listed in the Windows Add or Remove Programs.

    Note: If the registry tree structure differs for different Windows Operating Systems, then the administrator must create separate bundle for each operating system.

I would like to thank Lakshmi R and Harshad Sovani for reviewing this Cool Solution and providing valuable feedback.


Disclaimer: As with everything else at Cool Solutions, this content is definitely not supported by Novell (so don't even think of calling Support if you try something and it blows up).

It was contributed by a community member and is published "as is." It seems to have worked for at least one person, and might work for you. But please be sure to test, test, test before you do anything drastic with it.




User Comments

rpfenninger's picture

Why not use the msi mechanism?

Submitted by rpfenninger on 11 February 2008 - 1:26am.

I'd always recommend to do tasks like described above using the original msi mechanism.

To keep users from modifying or even uninstalling the ZENworks Adaptive Agent create a transform file (.mst) and add the following properties to the Property table:
ARPNOREMOVE = 1
ARPNOMODIFY = 1

That way, the agent still appears within the Control Panel applet which seems useful for the support personnel.

To totally hide the agent within that applet, you can delete the following actions from the InstallExecuteSequence and AdvtExecuteSequence tables (in the .mst as well). This keeps the setup from registering:
RegisterProduct
RegisterUser
PublishProduct
PublishFeatures

For further information check the msi.chm file that comes with the Windows Server 2003 Platform SDK.
http://www.microsoft.com/downloads/details.aspx?Fa...

© 2013 Novell