Set Restrictive Service Security Client Task

Arellia has two built-in tasks that set security descriptors and will accomplish most of what you are trying to accomplish:

1. Set Restrictive Service Security Client Task - removes the ability for Administrators to stop or modify a service.
2. Set Standard Service Security Client Task - sets the service security to the Windows default, giving Administrators the ability to stop or modify a service.

To apply restrictive service security:

1. Navigate to Tasks > Client Tasks > Local Security > Set Restrictive Service Security Client Task 
2. (optional) Clone the client task
3. Set the Service to the service you are targeting (ie. the Arellia Agent)
4. (optional) Set the security descriptor to a custom one
   
5. Save the client task
6. Select Run Now and execute the task on endpoints