How to restrict a user from killing a process or stopping a service

Hello there Mobi, and welcome to Geeks to Go!

You can disable the Task Manager through a group policy. (Start -> Run: gpedit.msc)
This would prevent all your users to access the Task Manager at all. However, keep in mind that if they have local administrative access, they can just remove that policy with their administrative powers.

There are very few -real- restrictions you can put on local administrative users.

Regards,
Olrik

actually...if you set the setting to restrict access to the task manager in the DOMAIN group policy...then the local admin SHOULDN'T be able to use task manager either (at least not a user that's a local admin....there's a chance that THE local admin account could do it)

Hehe, if I may offer another perspective...
My high school used the setup recommended by dsenette. The restrictions were VERY strict- No access to Run, Command Prompt, Registry Editor, Task Manager, or even the C drive. It wouldn't even let you type anything into the address bar of Windows Explorer, either.

Edit:removed instructions that "could" be used to get around settings in place on a misconfigured network

Moderators- my apologies if talking about this qualified as instructions on how to hack/exploit. I consider it to be a very innocuous weakness, besides which my intent was only to let the OP know about this problem, not to educate others about how to exploit it. Please do let me know if this violates any rules, though, and I will be happy to revise the post so that it does not go into the specifics of the shortcut technique.

i edited it for you....

at your school...the network was probably NOT configured as a domain...and the rules were probably not put in place at the domain level.

domain policy always trumps local policy so your method wouldn't (or at least shouldn't if the domain policy is set correctly) work...

also...it's very easy in domain policy to add gpedit.msc into the "unapproved" applications list thereby blocking it