unkillable process

Question

i am writing a program which includes a windows service and a GUI-program, because the windows service cannot directly communicate with windows.

It is a program which interacts which a server-daemon stopping pupils from logging in with one account at multiple workstations. (to prevent password sharing)

The GUI-process is launched using Windows autostart and runs with the users permissions. Because of that, the users can easily just kill the GUI-process. This is not good because the GUI-process is causing the logoff (and user message).

How can i stop users from killing the process?

Answer 1

Since you don't have the option of using OS security to prevent this, the technical answer is that it cannot be done. That leaves only workarounds or alternative approaches.

One workaround that is not officially supported, relies on undocumented features and which you didn't hear from me is this:

public static class Unkillable
{
    [DllImport("ntdll.dll", SetLastError = true)]
    private static extern void RtlSetProcessIsCritical(UInt32 v1, UInt32 v2, UInt32 v3);

    public static void MakeProcessUnkillable()
    {
        Process.EnterDebugMode();
        RtlSetProcessIsCritical(1, 0, 0);
    }

    public static void MakeProcessKillable()
    {
        RtlSetProcessIsCritical(0, 0, 0);
    }
}

After you call Unkillable.MakeProcessUnkillable, killing the process will result in an immediate BSOD. This is a really ugly solution, but it's hard to argue against "can be implemented in 2 minutes".

Another workaround would be to create a group of processes that cooperate by relaunching each other whenever one dies.