The default Arellia Agent and Arellia Application Control Agent installations allow Administrators to terminate those processes and services. This article will walk through how to prevent administrators from tampering with the Arellia Services.
Steps
- First the Arellia Agent and Application Control services need to be hardened against administrators. This can be done by Service Hardening in Local Security
This alters the service Security descriptors such that an administrator cannot stop services via the Service Control Manager.
- Second the Arellia processes can be protected against administrators by removing the Debug privilege from Administrators. The quick way to do it is enable the Remove Advanced Privileges for Interactive Users application control policy
Debug privileges are generally only made available to Developers. Debug privilege disables checks on the process security descriptor. The Remove Advanced Privileges for Interactive Users policy would generally be cloned to actually exclude those programs (developer tools ) that actually require debug rights such as Visual Studio.