My current problem is that I am trying to prevent a program from changing the attributes(specifically Write permissions) of its own files in order to stop the program from updating itself since it's connected to the Internet. What I have tried so far is denying the user under which the program is being executed to write(meaning modify/change) to the program's executable and all of its files with the help of icacls.exe. This built-in system tool can modify user permissions on files/folders. To start of, I granted Full Access to the program's executable and its files to clear all restrictions, then, I denied the followings:DE,WD,WDAC,WO,AS,WEA,WA (refer to the manual of icacls.exe to see what they stand for) but after relaunching the program, the attributes were reset to the program's advantage and it immediately began to update. After this failed attempt, I denied additional permissions such as: D but I could no longer start the program since I couldn't even dir the directory the program was located in. The same behaviour could be noticed with other additional denied permissions including, but not limited to, M, W, GW. I have also tried hiding away attrib.exe from the program since I noticed conhost.exe is always being called by the program at startup with the help of which it can pass an attrib.exe command to modify the attributes unless the user under which the program is running is denied to change attributes but again, denying M, W, GW permissions I mentioned previously restricts me from viewing the directory in which the program and its files are located let alone executing it. Could it be that the program is using the Windows API to change the attributes of its files? What are other methods to prevent this program from modifying attributes besides what I've already mentioned?
1. DO NOT work in administrative account. Create standard account and work there. Use administrative account only to set security permission on files you need or for installation/deinstallation of new programs or adjusting system settings. If your account is administrative then program can easily overwrite all your restrictions since it works in administrative account too.
2. Block outgoing connection in firewall for your stubborn program in advanced firewall settings.
You can try to revoke ownership from files you want to be unwritable and assign restricted user as an different owner (not an account that run program) but I guess functionality of program would be broken.