Hi,
Take a look at this: http://www.winhelponline.com/articles/15/1/How-to-hide-an-entry-in-the-AddRemove-Programs-applet.htm...
With regards to the service start/stop, while you can't easily stop your local admins from starting/stopping the Splunk service on Windows, you can monitor what's going on periodically:
- Monitor your System Event Logs and look for "Event Source: Service Control Manager" where description contains the name of the Splunk service. This will tell you when the service was stopped / started
- Use Splunk On Splunk or the Distributed Management Console to monitor the status of your Universal Forwarders. There are built-in searches to list UFs not reporting after certain amount of time that you can tweak to customise your needs
- If the number of Windows hosts you want to watch is not extremely huge you can always monitor the Splunk services remotely every minute or so by writing some basic PowerShell that either via WMI or built-in cmdlets keeps an eye on those services. A multithreaded approach is recommended here
But most importantly, there's something that really helped me in the past: get support from senior management on this. If someone senior enough informs your employees that stopping certain security/logging tools is not permitted unless there's a valid reason for it, people would think twice before doing so. It won't stop them but if they do, and you manage to find out, there will be consequences.
Hope that helps.
Thanks,
J
