Restricting the ZENworks Workstation Users from Uninstalling or Modifying the ZENworks Configuration Management

By Ravella Raghunadh

After deploying the ZENworks Adaptive Agent on a workstation, a user having administrator privileges can access and uninstall the product by using the Windows Add or Remove Programs. This Cool Solution helps ZENworks Administrators to restrict the workstation users from uninstalling or modifying the ZENworks software.


  1. On a managed device, export the ZENworks Folder registry key from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Uninstall\ZENworks to a local file. A sample registry file is shown in Figure 1.

    Figure 1 Sample registry file for a ZCM workstation.

  • Edit the registry file to add the following line:


  • A sample updated file is shown in Figure 2.

    Figure 2 Updated Registry file

  • Log in to ZENworks Control Center.

  • Add Registry Edit Action to the bundle.


    Click to enlarge.

    Figure 3 Add Actions window - Registry Edit Action selection

    Get more information on adding the Registry Edit Action.

  • Browse and import the updated registry file.

  • Assign the Bundle to ZENworks Configuration Management Devices/Users.

    For more information on assigning Bundle to the devices and users please refer to this page, and this page.

  • Configure the Bundle Distribution Schedule as “Event” and select “User Login” as trigger.

  • Select “Install Immediately after Distribution” and “Launch Immediately after Installation” options in Distribution schedule.

    For more details on Bundle Schedules, please refer to this page.

  • After the bundle is distributed to the managed device, the ZENworks application will not be listed in the Windows Add or Remove Programs.

    Note: If the registry tree structure differs for different Windows Operating Systems, then the administrator must create separate bundle for each operating system.

I would like to thank Lakshmi R and Harshad Sovani for reviewing this Cool Solution and providing valuable feedback.


How To-Best Practice
Comment List
  • I'd always recommend to do tasks like described above using the original msi mechanism.

    To keep users from modifying or even uninstalling the ZENworks Adaptive Agent create a transform file (.mst) and add the following properties to the Property table:

    That way, the agent still appears within the Control Panel applet which seems useful for the support personnel.

    To totally hide the agent within that applet, you can delete the following actions from the InstallExecuteSequence and AdvtExecuteSequence tables (in the .mst as well). This keeps the setup from registering:

    For further information check the msi.chm file that comes with the Windows Server 2003 Platform SDK.