I'm admining a render farm. The farm has its own service account which has local admin permissions. We use an app that has a bug which deletes a file and prevents itself from working correctly. I want to block a specific process from deleting a specific file. I don't care how this is achieved user rights, cheetah blood...
The catch is that the app needs to have admin rights granted for other purposes. I tried changing user rights and file attributes, but that didn't work.
Set the Deny Delete permission on the file for the user account under which the app runs. Even if the account has Administrative permissions, the Deny permission will have its effect. The only way a user with full administrative permissions can override an explicit deny permission is if the application specifically modifies the permissions on the file to remove the deny permission before deleting it.
If the bug in your application is doing that, you've got bigger fish to fry.
