protection SCCM

Dear all,
 
anyone knows how we can protect our sccm client from behavior other user, for example :
sms agent host disable, account sccm administrator remove by user.
or user delete folder CCM.
I think this is for security SCCM in order not to be disturbed by a user who nosy.
 
need your advise..
 
regards
Qer

As always there are many ways you can achieve what you are asking.
 
Does the user/s have local admin rights, if so I would recommend that you start trying to remove them post-hast
 
Here are some ideas for the problems you described.
 
SMS Agent host Disable: 

• Group Policy preferences can be your friend here as it re-evaluates regularly, which means that you can control the state which the SMS Host Agent is. They might be able to stop it but it will start up again in X minutes

Account removed from local admins:

• Again GPP can solve this for you. You can also use standard GPO's but they are lot more restrictive than GPP

Deleting the CCM folder: 

• This one is a bit tricker as depending on where it it is installed and what rights the user has over the system, you could change the permission on the directory to prevent the user being able to delete it. This will some serious testing. 
• The other option is something like this http://emptygarden.info/2011/01/19/sccm-computer-startup-scriptpart-1/  this will re-install the client if it isn't there. 

 
The other option is also to take it up with management if possible, your company has paid and implemented Config Mgr for a reason for someone to say. screw that! should  be taken up with management.

Thank's for you link to " thank you very much"
so, how i can setting Group Policy preferences?
 

These links should give you a start on what you are trying to do
 
Manage services
http://www.grouppolicy.biz/2010/08/how-to-use-group-policy-to-control-services/
 
Local admin
http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/

Thank you..but do you have other way?
because i can't find gpp.

Talk to management as stated above. Also look into removing admin rights for users. Group policy allows you to protect services only putting gorups that start or start that particular service. Like stated above get with management all companies have some type user acceptance policy for workstations. This could fall under a violation of that policy.

Taking away local admin permissions, as stated above by the others, is the *only* way to address this issue. If a user is a local admin, nothing you can do will stop them from doing whatever they want on the system.