I am pushing the Splunk forwarder out to a bunch of workstations. I don't want users to be able to remove the forwarder once it's installed. I've noticed that on my workstation I can go into the Add/Remove programs list in Windows and uninstall it. Also, I can stop the service from running. Is there any way to hide the forwarder from these places so that users don't remove it? Some of the users will have local admin rights so I don't think I can take away their ability to uninstall, but if it's hidden it's more likely to stay around.
... View more