Block steadystate access for an administrative user

Question

I want to set up a Windows XP machine with SteadyState. Is it possible to have a user with full administrator access with the exception of accessing or controlling SteadyState. This user should be able to do anything, including installing service packs or deleting system files, but not have the ability to disable or override disk protection. I am aware that you can disable the warning that administrators receive on shutdown.

There will be a separate user to administer SteadyState.

Answer 1

I figured it out myself. All you need to do is create the user in SteadyState, turn off all restrictions, then add a Program Restriction for the SteadyState UI. Then open the Users control panel and change the user to administrator. Then reboot, selecting to commit changes to disk when prompted. After rebooting, log back in as the user that can still access SteadyState, then under Disk Protection, uncheck the option to notify administrators of changes on shutdown.

I was able to test this user by uninstalling my antivirus and deleting files throughout Program Files until the computer was severely broken, and a reboot brought it back.

If there are any weaknesses to this answer, please feel free to post your own.