Disable ability to add startup items in Windows 7?

Question

Possible Duplicate:
Is there a tool like StartupMonitor for Windows 7?

Note: This is not the question "How to disable startup items" because the simple answer is: "Use msconfig".

Now as for my question: I recently am very annoyed that some programs add startup items to my PC without my knowledge after installation, I always have 2 programs which startup - Temperature monitor and the Catalyst Control Center Tray.

Now, sometimes I install something and it adds startup entries, how can I make sure that no startup entries can be added to windows anymore?

So what I would like to do:

-Disable adding scheduled tasks (even for administrator accounts, so programs installing from them can't add startup entries too)

-Disable adding startup entries to the registry (even for administrators, would changing the permissions in HKLM on the Microsoft\Windows\CurrentVersion\Run to read only be enough?)

-Disable all other methods of startup in Windows 7 I don't know

-Set default startup of NEW installed services to "Start Manually" instead of/and block "Start Automaticly" and "Start Automaticly (Delayed)"

How can I accomplish this?

This is also a nice way to prevent most viruses fom running after machine reboot (if this can be accomplished).

I am using 7 Ultimate so I have group policy editor, if that could be used.

Answer 1

There is not direct way of doing this. But you can try a workaround, you can have some script scheduled to run at Shutdown, and that script restores the registry entry to the previous state, a state which does not have unwanted registry entries. I have never tried it, but I think this should work.

Answer 2

What you're asking for cannot be done, because someone with administrative privileges can easily undo any restriction you apply. It's also not sensible, because you may seriously break software that requires a service to start automatically by forcing the service startup to "manual".

Basically, what you're asking is: "How can I protect a machine from its administrator?"

And the answer to this question is: "You can't."