Disallow Killing Script Via Task Manager

KEYWORDS: kill terminate close wbt script permit allow

Question:

Is there a way to ensure that a process I launch from one of my scripts (Internet Explorer, for example) is killed if my script is killed by the user (i.e. via Task Manager)??

To be more specific, I've put together something that runs a browser (right now via just a plain Run(browserpath, startURL)) and then puts up a timer dialog that counts down a number of seconds and kills the browser once time runs out (via tkillproc from the proc extender) - so the user can only run the browser for a few minutes at a shot. However, the problem is that a smart user can right now find the timer program in Task Manager and kill it, thus allowing the browser to stay alive indefinetly. Any way to have it so that if my process is killed any "child" processes it launched will die as well?? Interestingly enough, right now if the user just "Closes" my timer (with an Alt+F4, for example) the browser does go down as when the timer runs out.

Answer:

Get's kind of tricky....

Set your script to run hidden once it has been fully debugged.
Remove the task manager from the system configuration.
Use IntControl() to make your script ignore windows shut down requests and to ignore CTRL+BREAK.

I can't think of much else that you can do to make the timer process unkillable except for running it as a service. Perhaps the sneaky thing to do would be to have the real timer running as a system all the time, and have it read some common portion of the registry under HKLM looking for the PIDs of parent processes [dummy timers] that started instances of IE in interactive user sessions. These dummy timers would launch IE, store their own PID values in the registry and then terminate. The user's would then be left with an instance of IE running that the service would then terminate after a period of time.

As for killing child processes, as long as you know the PID [Process ID] of the process that started the browser, then it is possible to interrogate each process on the system [requires admin privileges] to see if each one is descended from the specified parent process. When you find a match, kill the process and store its PID in a list and then interrogate processes on the system again in case the browser spawned off child browsers. Do this until nothing is left in the process tree. If you're doing this in a Terminal Services / Citrix environment, then the WTS extender can be of some assistance as it can list processe that are running within a specific session, and you might want to simply kill all instances of IE that are running in any particular session to make sure that the session [even if there is only 1 session] is no longer running any instances of IE.

One follow-up to the service idea... on Win2K & newer, you can configure services to automatically restart even if they die. This could make your service even more resiliant to rogue process termination via the task manager as long as as the permissions on the service restrict even power users from stopping the service via the service control manager.

Article ID:   W16496

File Created: 2005:02:18:12:21:00

Last Updated: 2005:02:18:12:21:00

Database Search

TechHome