title: Prevent user process from being killed with "End Process" from Process Explorer
body: <p>I noticed that GoogleToolbarNotifier.exe cannot be killed from Process Explorer.  It returns "Access Denied".  It runs as the user, it runs "Normal" priority, and it runs from Program Files.</p>
  
  <p>How did they do it?</p>
  
  <p>I think there might be a way to modify the ACL, or mark the process as 'critical', but I cannot seem to locate anything.</p>
  
  <p><strong>Update:</strong></p>
  
  <p>I found the answer with a good bit of digging.  @Alex K. was correct in that PROCESS_TERMINATE permission was removed for the process, but I wanted to supply the answer in code:</p>
  
  <pre><code>static const bool ProtectProcess()
  {
      HANDLE hProcess = GetCurrentProcess();
      EXPLICIT_ACCESS denyAccess = {0};
      DWORD dwAccessPermissions = GENERIC_WRITE|PROCESS_ALL_ACCESS|WRITE_DAC|DELETE|WRITE_OWNER|READ_CONTROL;
      BuildExplicitAccessWithName( &amp;denyAccess, _T("CURRENT_USER"), dwAccessPermissions, DENY_ACCESS, NO_INHERITANCE );
      PACL pTempDacl = NULL;
      DWORD dwErr = 0;
      dwErr = SetEntriesInAcl( 1, &amp;denyAccess, NULL, &amp;pTempDacl );
      // check dwErr...
      dwErr = SetSecurityInfo( hProcess, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, pTempDacl, NULL );
      // check dwErr...
      LocalFree( pTempDacl );
      CloseHandle( hProcess );
      return dwErr == ERROR_SUCCESS;
  }
  </code></pre>